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Foreword 



rd , 



This Technical Specification (TS) has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document specifies the stage 2 of the LoCation Services (LCS) feature in UMTS and GSM, which provides 
the mechanisms to support mobile location services for operators, subscribers and third party service providers. 

The present document replaces the specifications TS 23. 171 (Release 1999) and the system and core network parts of 
GSM 03.71 (Release 1999). TS 43.059[16] replaces the radio access network parts of GSM 03.71 (Release 1999). 

Location Services may be considered as a network provided enabling technology consisting of standardised service 
capabilities, which enable the provision of location applications. The application(s) maybe service provider specific. 
The description of the numerous and varied possible location applications which are enabled by this technology are 
outside the scope of the present document. However, clarifying examples of how the functionality being described may 
be used to provide specific location services may be included. 

This stage 2 service description covers the LCS system functional model for the whole system, the LCS system 
architecture, state descriptions, message flows, etc. 



References 



The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. In the case of a reference to a 3GPP document (including 
a GSM document), a non-specific reference implicitly refers to the latest version of that document in the same 
Release as the present document. 

2.1 Normative references 

[I] 3GPP TS 25.305: "Stage 2 functional specification of UE positioning in UTRAN". 
[2] (void) 

[3] 3GPP TS 21.905: "Vocabulary for 3GPP Specifications". 

[4] 3GPP TS 22.071: "Technical Specification Group Systems Aspects; Location Services (LCS); 

Stage 1". 

[5] (void) 

[6] (void) 

[7] (void) 

[8] 3GPP TS 22.101: "Service principles". 

[9] (void) 

[10] (void) 

[II] 3GPP TS 23.032: "Universal Geographical Area Description (GAD)". 
[12] (void) 

[13] (void) 

[14] 3GPP TS 25.413: "UTRAN lu Interface RANAP signaHng". 
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[15] 3GPP TS 23.060: "General Packet Radio Service (GPRS); Service description; Stage 2". 

[16] 3GPP TS 43.059: "Functional Stage 2 description of Location Services in GERAN". 

[17] 3GPP TS 23.003: "Numbering, addressing and identification". 

[18] 3GPP TS 29.002: "Mobile Application Part (MAP) Specification" . 

[19] (void) 

[20] 3GPP TS 23.002: "Network architecture". 

[21] 3GPP TS 23.078: "Customised Applications for Mobile network Enhanced Logic (CAMEL) - 

stage 2". 

[22] 3GPP TS 23.01 1: "Technical realization of Supplementary Services". 

[23] 3GPP TS 23.007: "Restoration procedures". 

[24] 3GPP TS 24.008: "Mobile Radio Interface - Layer 3 MM/CC Specification". 

[25] 3GPP TS 25.33 1 "RRC protocol specification". 

[26] 3GPP TS 23. 127 "Virtual Home Environment/Open Service Access". 

[27] 3GPP TS 29.198-1: " Open Service Access (OSA); Application Programming Interface (API); Part 

1; Overview". 

[28] 3GPP TS 29.198-2: " Open Service Access (OSA); Application Programming Interface (API); Part 

2; Common Data ". 

[29] 3GPP TS 29.198-3: "Open Service Access (OSA); AppHcation Programming Interface (API); Part 

3; Framework ". 

[30] 3GPP TS 29.198-6: "Open Service Access (OSA); AppHcation Programming Interface (API); Part 

6: Mobility". 

[31] OMA Location Working Group "Mobile Location Protocol Specification", 

[http://www.openmobilealliance.org] 

[32] ANSI J-STD-036A: "Enhanced Wireless 9-1-1 Phase 2 " 

[33] RFC 2396: "Uniform Resource Identifiers ". 

[34] RFC 3261: "SIP: Session Initiation Protocol". 

[35] 3GPP TS 23.228: "IP multimedia subsystem (IMS)" 

[35a] ITU Recommendation E.164: "The international public telecommunication numbering plan". 

[35b] 3GPP TS 22.060: "General Packet Radio Service (GPRS); Service Description, Stage 1". 

2.2 Informative references 

[36] Third generation (3G) mobile communication system; Technical study report on the location 

services and technologies, ARIB ST9 December 1998. 

[37] The North American Interest Group of the GSM MoU ASSOCIATION: Location Based Services, 

Service Requirements Document of the Services Working Group. 
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3 Definitions, symbols and abbreviations 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

CAMEL: CAMEL is a network functionality, which provides the mechanisms of Intelligent Network to a mobile user 

Call Related: any LCS related operation which is associated with an established call in CS domain and a session via an 
active PDP context in PS domain. 

Codeword: access code, which is used by a Requestor or LCS Client in order to gain acceptance of a location request 
for a Target UE. The codeword is part of the privacy information that may be registered by a Target UE user. 

Current Location: after a location attempt has successfully delivered a location estimate and its associated time stamp, 
the location estimate and time stamp is referred to as the "current location" at that point in time 

Deferred location request: location request where the location response (responses) is (are) required after a specific 
event has occurred. The event may or may not occur immediately 

Global Positioning System: Global Positioning System (GPS) consists of three functional elements: Space Segment 
(satellites). User Segment (receivers), and Control Segment (maintenance etc.). The GPS receiver calculates its own 
position based on the received time differences for several satellites 

Immediate location request: location request where a single location response only is required immediately 

Initial Location: in the context of an originating emergency call the location estimate and the associated time stamp at 
the commencement of the call set-up is referred to as "initial location" 

Last Known Location: current location estimate and its associated time stamp for Target UE stored in the LCS Server 
is referred to as the "last known location" and until replaced by a later location estimate and a new time stamp is 
referred to as the "last known location" 

LCS (Location Services): LCS is a service concept in system (e.g. GSM or UMTS) standardization. LCS specifies all 
the necessary network elements and entities, their functionalities, interfaces, as well as communication messages, due to 
implement the positioning functionality in a cellular network. Note that LCS does not specify any location based (value 
added) services except locating of emergency calls 

LCS Client: software and/or hardware entity that interacts with a LCS Server for the purpose of obtaining location 
information for one or more Mobile Stations. LCS Clients subscribe to LCS in order to obtain location information. 
LCS Clients may or may not interact with human users. The LCS Client is responsible for formatting and presenting 
data and managing the user interface (dialogue). The LCS Client may reside in the Mobile Station (UE) 

LCS Client Access barring list: optional list of MSISDNs per LCS Client where the LCS Client is not allowed to 
locate any MSISDN therein 

LCS Client Subscription Profile: collection of subscription attributes of LCS related parameters that have been agreed 
for a contractual period of time between the LCS client and the service provider 

LCS Feature: capability of a PLMN to support LCS Client/server interactions for locating Target UEs 

LCS QoS Class: The QoS class determines the degree of adherence to the quality of service information as required by 
the source of a location request 

LCS Server: software and/or hardware entity offering LCS capabilities. The LCS Server accepts requests, services 
requests, and sends back responses to the received requests. The LCS server consists of LCS components, which are 
distributed to one or more PLMN and/or service provider 

LDR reference number: Unique identity of a Location Deferred Request, which is assigned and maintained by the R- 
GMLC and circulated between the LCS Client, R-GMLC, H-GMLC, V-GMLC, MSC/SGSN and UE. Notes: UE is 
involved only when the event type of the deferred request is 'change of area'. In addition, in a Periodical 
Immediate/deferred LCS Service Request, the LDR reference number is exclusive. 
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Local Information: information related to a given location, or general information, which is made available in a given 
location 

Local Service: service, which can be exclusively provided in the current serving network by a Value added Service 
Provider 

Location (Based) Application: location application is an application software processing location information or 
utilizing it in some way. The location information can be input by a user or detected by network or UE. Navigation is 
one location application example 

Location Based Service (LBS): service provided either by teleoperator or a 3'^ party service provider that utilizes the 
available location information of the terminal. Location Application offers the User Interface for the service. LBS is 
either a pull or a push type of service (see Location Dependent Services and Location Independent Services). In 
ETSI/GSM documentation of SoLSA, LBS is called "Location Related Service". ETSI and/or 3GPP -wide terminology 
harmonization is expected here 

Location Dependent Service: service provided either by teleoperator or a 3"* party service provider that is available 
(pull type) or is activated (push type) when the user arrives to a certain area. It doesn't require any subscription in 
advance, but the push type activation shall be confirmed by the user. The offered service itself can be any kind of 
service (e.g. a public Xerox machine or the discount list in a store) 

Location Estimate: geographic location of an UE and/or a valid Mobile Equipment (ME), expressed in latitude and 
longitude data. The Location Estimate shall be represented in a well-defined universal format. Translation from this 
universal format to another geographic location system may be supported, although the details are considered outside 
the scope of the primitive services 

Location Independent Service: service provided either by teleoperator or a 3'^'' party service provider that is available 
and therefore can be activated anywhere in the network coverage. It is activated by the user's request or by other user's 
activated service, and therefore it requires a subscription in advance (pull type). The offered service itself can be any 
kind of service (e.g. MMS, SWDL, or LBS!) 

Mobile Assisted positioning: any mobile centric positioning method (e.g. IPDL-OTDOA, E-OTD, GPS) in which the 
UE provides position measurements to the network for computation of a location estimate by the network. The network 
may provide assistance data to the UE to enable position measurements and/or improve measurement performance 

Mobile Based positioning: any mobile centric positioning method (e.g. IPDL-OTDOA, E-OTD, GPS) in which the UE 
performs both position measurements and computation of a location estimate and where assistance data useful or 
essential to one or both of these functions is provided to the UE by the network. Position methods where an UE 
performs measurements and location computation without network assistance data are not considered within this 
category 

Mobile Station: mobile station (MS) consists of Mobile or User Equipment (ME or UE) with a valid SIM or USIM 
attached. The abbreviation "UE" in this specification refers both to MS and User Equipment, see below. 

Non-dialable call back number: In case of a SIM-less emergency call, a non-dialable callback number shall be used to 
identify the target UE. The format and structure of the non-dialable callback number is according to national or regional 
regulations. 

PLMN Access barring list: optional list of MSISDN per PLMN where any LCS Client is not allowed to locate any 
MSISDN therein except for certain exceptional cases 

Positioning (/location detecting): positioning is a functionality, which detects a geographical location (of e.g. a mobile 
terminal) 

Positioning method (/locating method): method or technical solution, which is used to get an estimate of the target 
mobile's geographical location. For example positioning methods based on radio cell coverage, GPS or Assisted GPS 
methods, which are based on the Time-Of- Arrival (TO A) algorithm, and OTDOA or E-OTD methods, which are based 
on the Time-Difference-Of- Arrival (TDOA) algorithm. The positioning methods are further described in UTRAN Stage 
2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

Predefined area: geographical area, which is not related to cell or radio coverage. The mobile may take special action 
when it recognises it has entered or left a predefined area 
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Privacy Class: list of LCS Clients defined within a privacy exception class to which permission may be granted to 
locate the target UE. The permission shall be granted either on activation by the target UE or permanently for a 
contractual period of time agreed between the target UE and the service provider 

Privacy Exception List: list consisting of various types of privacy classes (i.e. operator related, personal etc.). Certain 
types of classes may require agreement between the service provider and the target UE 

Privacy Profile Register, PPR: The PPR stores privacy information of the target mobile. The PPR also executes 
privacy checks and sends the privacy check results to other network elements using the Lpp interface. PPR may be a 
standalone network entity or the PPR functionality may be integrated in H-GMLC. 

Prohibited area: area where the mobile must not activate its transmitter. The Prohibited area may be a Predefined area 
described above or related to radio cell(s) 

Pseudo-external identity: The pseudo-external identity is not the identity of real external LCS client but the identity, 
which is used for notifying the result of the enhanced privacy check. The pseudo-external identity shall keep the 
compatibility with pre Rel-6 privacy mechanisms, which does not understand privacy check result made by H- 
GMLC/PPR. Each operator defines its own the pseudo-external identities. 

Pseudonym: A fictitious identity, which may be used to conceal the true identity (i.e. MSISDN and IMSI) of a target 
UE from the requestor and the LCS client. 

Pseudonym mediation device: functionality that verifies pseudonyms to verinyms 

Request id: identity which is used to identify the correspondence of a location request to multiple responses when the 
Response method is ASYNC. Each receiving GMLC (R-GMLC or V-GMLC or H-GMLC) allocates and maintains the 
Request id to identify each ASYNC location request, and includes it in the responses to the source entity of the location 
request (i.e. LCS client or GMLC). 

Requestor: the originating entity which has requested the location of the target UE from the LCS client. 

Requestor Identity: This identifier is identifying the Requestor and can be e.g. MSISDN or logical name. 

Response method: method how a GMLC, which receives a location request message from another entity (i.e. LCS 
client or GMLC), responds to the location request. There are two methods, synchronous (SYNC) and asynchronous 
(ASYNC). When the requesting entity wishes multiple responses (either about one or several target UE"s location) to a 
single location request the procedure is ASYNC and when the requesting entity wishes a single response the procedure 
is SYNC. The source entity of the location request (i.e. LCS client or GMLC) can choose a preferred method and 
informs the method to the receiving GMLC. However, the selection of the method used is made by the receiving GMLC 
and when the ASYNC method is selected the Request id is notified to the source entity. The receiving GMLC can turn a 
SYNC request into an ASYNC procedure, e.g. in an overload situation, and the source entity (i.e. LCS client or GMLC) 
should be able to receive multiple responses even though the request was SYNC. 

Service Area Identifier (SAI): information, which is used to identify an area consisting of one or more cells belonging 
to the same Location Area, see ref. [14]. Such an area is called a Service Area and can be used for indicating the 
location of a UE to the CN. For this specification, only a Service Area that is defined to be applicable to the PS and CS 
domains shall be used. 

Service coverage: a list of country codes where an LCS client offers its location services. Country code in this context 
means E. 164 country code for a geographic area [35a]. 

Service Type: attribute of specific location based service provided by the LCS client, as defined in TS 22.071. 

Serving cell identity: the Cell Global Identification (CGI), see ref [17], of the cell currently used by the target UE, e.g. 
for an emergency call in A-mode. 

Subscription Profile: profile detailing the subscription to various types of privacy classes 

Target area: geographical area which is used for change of area type deferred location request. The target area is 
defined by the LCS client and is expressed as geographical area using a shape defined in TS 23.032 [11], as a 
geographical area using local coordinate system, as an E.164 country code for a geographic area [35a], as a PLMN 
identity or as a geopolitical name of the area (e.g. London). 

Target UE: UE being positioned 
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User Equipment: term 'User Equipment', or 'UE', as defined in 3GPP TS 21.905 [3]. UE in this specification may also 
refer to a Mobile Equipment or User Equipment used for emergency calls, that do not have valid SIM or USIM 

Verinym: True identity, i.e. MSISDN or IMSl, of the target UE 

Further UMTS related definitions are given in 3GPP TS 22.101 [8]. 



3.2 Symbols 



For the purposes of the present document, the following symbols apply: 



Dh 
Gb 
Gs 

Lc 
Le 
Lg 

Lh 

Lid 

Lpp 

Lr 

Sh 

Um 

Uu 



Interface between LIMS-IWF and SLF 

Interface between 2G-SGSN and BSS 

Interface between MSC and SGSN 

Interface between gateway MLC and gsmSCF (CAMEL interface) 

Interface between External User and MLC (external interface) 

Interface between Gateway MLC - VMSC, GMLC - MSC Server, GMLC - SGSN (gateway MLC 

interface) 

Interface between Gateway MLC and HLR (HLR interface) 

Interface between GMLC and PMD. 

Interface between GMLC(H-GMLC) and PPR entity. 

Interface between Gateway MLCs 

Interface between LIMS-IWF and HSS 

GERAN Air Interface 

UTRAN Air Interface 



3.3 



Abbreviations 



For the purposes of the present document, the following abbreviations apply: 

2G- Second Generation 

3G- Third Generation 

AC Admission Control 

AI Application Interface (prefix to interface class method) 

ANM Answer Message (ISUP) 

APN Access Point Name 

APN-NI APN Network Identifier 

ARIB Association of Radio Industries and Business 

ATD Absolute Time Difference 

BCCH Broadcast Control Channel 

BER Bit Error Rate 

BSS Base Station Subsystem 

BTS Base Transceiver Station 

CAMEL Customised Application For Mobile Network Enhanced Logic 

CAP CAMEL Application Part 

CM Connection Management 

CN Core Network 

CSE Camel Service Environment 

DL Downlink 

DNS Domain Name System 

DRNC Drift RNC 

E-OTD Enhanced Observed Time Difference 

FER Frame Error Rate 

GERAN GSM EDGE Radio Access Network 

GGSN Gateway GPRS Support Node 

GMLC Gateway MLC 

GPRS General Packet Radio Service 

GPS Global Positioning System 

HE Home Environment 

H-GMLC Home-GMLC 

H-LIMS-IWF Home-LIMS-IWF 
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HSS Home Subscriber Server 

HLR Home Location Register 

HPLMN Home Public Land Mobile Network 

IMEI International Mobile Equipment Identity 

IMS IP Multimedia Subsystem 

IMSI International Mobile Subscriber Identity 

IP Internet Protocol 

IPDL Idle Period Downlink 

LA Location Application 

LAP Location Application Function 

LBS Location Based Services 

LCAF Location Client Authorization Function 

LCCF Location Client Control Function 

LCCTF Location Client Co-ordinate Transformation Function 

LCF Location Client Function 

LCZTF Location Client Zone Transformation Function 

LCS Location Services 

LDR Location Deferred Request 

LIMS-IWF Location IMS - Interworking Function 

LIR Location Immediate Request, 

LMU Location Measurement Unit 

LSAF Location Subscriber Authorization Function 

LSBcF Location System Broadcast Function 

LSBF Location System Billing Function 

LSCF Location System Control Function 

LSCTF Location System Co-ordinate Transformation Function 

LSOF Location System Operation Function 

LSPF Location Subscriber Privacy Function 

LSTF Location Subscriber Translation Function 

MAP Mobile Application Part 

ME Mobile Equipment 

MExE Mobile Execution Environment 

MLC Mobile Location Center 

MLP Mobile Location Protocol 

MM Mobility Management 

MO-LR Mobile Originated Location Request 

MS Mobile Station 

MSC Mobile services Switching Centre 

MSISDN Mobile Station Integrated Services Data Network 

MT-LR Mobile Terminated Location Request 

NA-ESRD North American Emergency Service Routing Digits 

NA-ESRK North American Emergency Service Routing Key 

NI-LR Network Induced Location Request 

OMA Open Mobile Alliance 

OSA Open Service Architecture 

OTDOA Observed Time Difference Of Arrival 

PC Power Control 

PCF Power Calculation Function 

PLMN Public Land Mobile Network 

PMD Pseudonym mediation device functionality 

POI Privacy Override Indicator 

PPR Privacy Profile Register 

PRCF Positioning Radio Co-ordination Function 

PRRM Positioning Radio Resource Management 

PSE Personal Service Environment 

PSMF Positioning Signal Measurement Function 

PSTN Public Switched Telephone Network 

QoS Quality of Service 

RA Routing Area 

RACH Random Access Channel 

RAN Radio Access Network 

RANAP Radio Access Network Application Part 
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R-GMLC Requesting-GMLC 

RIS Radio Interface Synchronization 

R-LIMS-IWF Requesting-LIMS-IWF 

RNC Radio Network Controller 

RRM Radio Resource Management 

RTD Real Time Difference 

SAI Service Area Identifier 

SAT SIM Application Tool-Kit 

SCCP Signalling Connection Control Part 

SCS Service Capability Server 

SGSN Serving GPRS Support Node 

SI Service Interface (prefix to interface class method) 

SIM Subscriber Identity Module 

SIP Session Initiation Protocol 

SIP-URI SIP Uniform Resource Identifier 

SIR Signal Interference Ratio 

SLF Subscription Locator Function 

SLPP Subscriber LCS Privacy Profile 

SMLC Serving Mobile Location Center 

SMS Short Message Service 

SP Service Point 

SRNC Serving RNC 

SS7 Signaling System No 7 

TA Timing Advance 

TEL-URL Telephone Uniform Resource Locator 

TMSI Temporary Mobile Subscriber Identity 

TOA Time Of Arrival 

UDT SCCP Unitdata message 

UE User Equipment 

UL UpUnk 

UMTS Universal Mobile Telecommunication System 

USIM Universal Subscriber Identity Module 

U-TDOA Uplink Time Difference of Arrival 

UTRAN Universal Terrestrial Radio Access Network 

VASP Value Added Service Provider 

V-GMLC Visited -GMLC 

VHE Virtual Home Environment 

WCDMA Wideband Code Division Multiple Access 

Further related abbreviations are given in 3GPP TS 21.905 [3]. 
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Main concepts 



A general description of location services and service requirements are given in the specification TS 22.071 [4]. The 
positioning of the UE is a service provided by the Access Network. In particular, all Access Networks (e.g. UTRAN, 
GERAN), that facilitate determination of the locations of User Equipments, shall be able to exchange location 
information with the core network as defined in the present document (when connected to a Core Network). Optionally, 
location information may also be communicated between GMLCs, located in the same or a different PLMN, via the 
specified GMLC to GMLC interface. 

By making use of the radio signals the capability to determine the (geographic) location of the user equipment (UE) or 
mobile station (UE) shall be provided. The location information may be requested by and reported to a client 
(application) associated with the UE, or by a client within or attached to the Core Network. The location information 
may also be utilised internally in the system; for example, for location assisted handover or to support other features 
such as home location billing. The position information shall be reported in standard, i.e. geographical co-ordinates, 
together with the time-of-day and the estimated errors (uncertainty) of the location of the UE according to specification 
TS 23.032 [11]. 

It shall be possible for the majority of the UE (active or idle) within a network to use the feature without compromising 
the radio transmission or signalling capabilities of the GSM/UMTS networks. 

The UE and the network may support a number of different positioning methods and the UE may support or not support 
privacy invocation request and response. The UE informs the core network and radio access network about its LCS 
capabilifies in this respect as defined in TS 24.008 [24] and TS 25.331 [25]. 

The uncertainty of the location measurement shall be network design (implementation) dependent at the choice of the 
network operator, this is further described in TS 25.305 [1] and TS 43.059 [16]. 

There are many different possible uses for the location information. The positioning feature may be used internally by 
the GSM/UMTS network (or attached networks), by value-added network services, by the UE itself or through the 
network, and by "third party" services. The positioning feature may also be used by an emergency service (which may 
be mandated or "value-added"), but the position service is not exclusively for emergencies. 

There are regulatory requirements to support anonymity in location services in some countries. 

4.1 Assumptions 

As a basis for the further development work on LCS in GSM and UMTS the following assumptions apply: 

positioning methods are Access Network specific, although commonalties should be encouraged between Access 
Networks; 

commercial location services are only applicable for an UE with a valid SIM or USIM; 

the provision of the location services in the Access Network is optional through support of the specified 
method(s); 

the provision of location services is optional in MSC and SGSN; 

LCS is applicable to any target UE whether or not the UE supports LCS, but with restrictions on choice of 
positioning method or notification of a location request to the UE user when LCS or individual positioning 
methods, respectively, are not supported by theUE; 

LCS shall be applicable for both circuit switched and packet switched services; 

the location information may be used for internal system operations to improve system performance; 

it shall be possible to accommodate future techniques of measurement and processing to take advantage of 
advancing technology so as to meet new service requirements; 

it may be necessary to support LCS signalling between separate access networks via the core network. The lur 
interface should be used if available. 
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Provide positioning procedures through the circuit-switched domain are also applicable to GPRS UEs which are 
GPRS and IMSI attached. 



4.2 Location Services Categories 



Generally there are four categories of usage of the location service. These are the Commercial LCS, the Internal LCS, the 
Emergency LCS and the Lawful Intercept LCS. The definition of these services and their categories is outside the scope of 
the present document. 

The Commercial LCS (or Value Added Services) will typically be associated with an application that provides a 
value-added service to the subscriber of the service, through knowledge of the UE location and if available, and at the 
operator"s discretion, the positioning method used to obtain the location estimate. This may be, for example, a 
directory of restaurants in the local area of the UE, together with directions for reaching them from the current UE 
location. 

The Internal LCS will typically be developed to make use of the location information of the UE for Access Network 
internal operations. This may include; for example, location assisted handover and traffic and coverage measurement. 
This may also include support certain O&M related tasks, supplementary services, IN related services and GSM 
bearer services and teleservices. 

The Emergency LCS will typically be part of a service provided to assist subscribers who place emergency calls. In 
this service, the location of the UE caller and, if available, the positioning method used to obtain the location estimate 
is provided to the emergency service provider to assist them in their response. This service may be mandatory in 
some jurisdictions. In the United States, for example, this service is mandated for all mobile voice subscribers. 

The Lawful Intercept LCS will use the location information to support various legally required or sanctioned 

services. 



4.3 Positioning methods 



The LCS feature utilises one or more positioning methods in order to determine the location of user equipment (UE). 
Determining the position of a UE involves two main steps: 

Radio signal measurements; and 

Position estimate computation based on the measurements. 

The positioning methods for UTRAN are further described in TS 25.305 [1]. 

4.3.1 Standard LCS IVIethods in UTRAN 

The specification TS 25.305 [1] UTRAN Stage 2 specifies the locating methods to be supported: 

cell coverage based positioning method; 

OTDOA positioning method; 
- GPS based positioning methods. 
For more details on these positioning methods, refer to TS 25.305 [1]. 

4.3.2 Standard LCS IVIethods in GERAN 

The specification TS 43.059 [16] GERAN LCS Stage 2 specifies the locating methods to be supported in GERAN: 
cell coverage based positioning method; 

Enhanced Observed Time Difference (E-OTD) positioning method; 
GPS based positioning methods; 
Uplink Time Difference of Arrival (U-TDOA) positioning method. 
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4.4 Types of Location Request 

4.4.1 Immediate Location Request 

Request for location where the LCS Server replies immediately to the LCS Client with the current location estimate if 
this could be obtained. 

4.4.2 Deferred Location Request 

Request for location contingent on some current or future events where the response from the LCS Server to the LCS 
Client may occur some time after the request was sent. 

4.4.2.1 Types of event 

a) UE available: Any event in which the MSC/SGSN has established a contact with the UE. Note, this event is 
considered to be applicable when the UE is temporarily unavailable due to inaction by the user, temporarily loss 
of radio connectivity or IMSI detach and so on. Note that IMSI detach is only applicable in the case the UE has 
previously been registered and information is still kept in the node. The UE Available event only requires one 
response and after this response, the UE Available event is concluded. 

b) Change of Area: An event where the UE enters or leaves a pre-defined geographical area or if the UE is 
currently within the pre-defined geographical area. The LCS client defines the target area as a geographical area, 
as an E.164 country code for a geographic area [35a], as a PLMN identity or as a geopolitical name of the area. 
The LCS server may translate and define the target area as the identities of one or more radio cells, location 
areas, routing areas, country code or PLMN identity. The target UE must not give the target UE user access to 
the area definitions and network identities. The change of area event may be reported one time only, or several 
times. The area event report must not be repeated more often than allowed by the LCS client. The change of area 
event report shall contain an indication of the event occurrence. The location estimate may be included in the 
report. 

c) Other events are FFS 



5 General LCS architecture 

5.1 LCS access interfaces 

One or more LCS Clients may access a Location Server via its Le interface. Location Servers, resident in the same or 
different PLMNs, may communicate with each other, indirectly, via the Lg interface to their associated MSC/SGSNs. 
Optionally, the Lr interface, as specified for direct GMLC to GMLC messaging, may be used for this purpose. A fuller 
description of the LCS architecture, together with a diagram showing other LCS related interfaces, can be found in 
clause 6. 
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Figure 5.1 : LCS Access Interfaces and Reference Points 



5.2 LCS Functional diagram, high level functions 

TS 22.071 [4] describes LCS services from the LCS client point of view. In the present document, a more detailed 
description of LCS is given. The LCS functional diagram shown in figure 5.2 depicts the interaction of the LCS client 
and the LCS server within the PLMN. The PLMN uses the various LCS components within the LCS server to provide 
the target UE Location Information to the LCS client. 
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Figure 5.2: LCS capability server Functional Diagram 
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The following list gives the logical functional entities for the LCS. Two main functional groupings are defined which 
encompass a number of smaller functions. 

The LCS Functional entities are grouped as follows: 
the LCS Client functional group; 

the LCS Server functional group consists of functions in the UMTS PLMN supporting LCS: 

client handling component; 

system handling component; 

subscriber handling component; 

positioning component. 
The functions of the LCS Client and the LCS Server in the PLMN are described in more detail in this clause. 
The allocation of LCS functions to network elements is specified in clause 6. 



5.3 LCS Client functional group 



An LCS client contains an LCS component with one or more client(s), which by using location information can provide 
location, based services. 

An LCS client is a logical functional entity that requests from the LCS server in the PLMN location information for one 
or more than one target UE within a specified set of parameters such as Quality of Service (QoS). The LCS Client may 
reside in an entity (including the UE) within the PLMN or in an entity external to the PLMN. 

The specification of the LCS Client's internal logic and its relation to the external use is outside the scope of the present 
document. 

5.3.1 External Location Client Function (LCF) 

The Location Client Function (LCF) provides a logical interface between the LCS client and the LCS server. 

This function is responsible for requesting location information for one or more UEs, with a specified "QoS" and 
receiving a response, which contains either location information or a failure indicator. 



5.4 LCS Server functional group 



The LCS server functional group consists of the functions that are needed for GSM and UMTS to support Location 
Services. 

5.4.1 Client handling component 

5.4.1 .1 Location Client Control Function (LCCF) 

The Location Client Control Function (LCCF) manages the external interface towards LCF. The LCCF identifies the 
LCS client by requesting client verification and authorization (i.e. verifies that the LCS client is allowed to position the 
subscriber) through interaction with the Location Client Authorization Function (LCAF). The LCCF handles mobility 
management for location services (LCS) e.g., forwarding of positioning requests to VMSC or SGSN. The LCCF 
determines if the final positioning estimate satisfies the QoS for the purpose of retry/reject. The LCCF provides flow 
control of positioning requests between simultaneous positioning requests. It may order the Location Client Co-ordinate 
Transformation Function (LCCTF) to perform a transformation to local co-ordinates. It may also order a transformation 
of local co-ordinates to network identities via the Location System Co-ordinate Transformation Function (LSCTF). It 
also generates charging and billing related data for LCS via the Location System Billing Function (LSBF). 
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5.4.1 .2 Location Client Authorization Function (LCAF) 

The Location Client Authorization Function (LCAF) is responsible for providing access and subscription authorization 
to a client. Specifically, it provides authorization to a LCS client requesting access to the network and authorizes the 
subscription of a client. LCAF provides authorization to a LCS client requesting Location Information of a specific UE. 

5.4.1.2.1 Access Subfunctlon 

An Access Subfunction enables LCS clients to access LCS services. This subfunction provides verification and 
authorization of the requesting client. 

When a LCS is requested, the Access Subfunction uses the information stored in the LCS client subscription profile to 
verify that: 

the LCS client is registered; and 

the LCS client is authorized to use the specified LCS request type; 

the LCS client is allowed to request location information for the subscriber(s) specified in the LCS request. 

5.4.1.2.2 Subscription Subfunction 

The LCS client Subscription profile shall contain a minimum set of parameters assigned on per LCS client basis for an 
agreed contractual period. The LCS client profile shall contain the following set of access parameters: 

LCS client identity; 

allowed LCS request types (i.e. LIR, LDR or both) (see note); 

maximum number of subscribers allowed in a single LCS request; 

priority; 

position override indicator; 

state(s); 

event(s) (applicable to LDR requests only); 

local coordinate system; 

LCS client access barring list (optional); 

PLMN access barring list applicability. 

NOTE: LIR = Location Immediate Request; and 
LDR = Location Deferred Request. 

For certain authorized LCS client internal to the PLMN, a subscription profile is unnecessary. These clients are 
empowered to access any defined service that is not barred for an UE subscriber. This permits positioning of emergency 
calls without the need for pre-subscription. 

5.4.1 .3 Location Client Co-ordinate Transformation Function (LCCTF) 

The Location Client Co-ordinate Transformation Function (LCCTF) provides conversion of a location estimate 
expressed according to a universal latitude and longitude system into an estimate expressed according to a local 
geographic system understood by the LCF and known as location information. The local system required for a 
particular LCF will be either known from subscription information or explicitly indicated by the LCF. The LCCTF also 
provides the conversion of a target area to either a shape as defined in TS 23.032 [11], a PLMN, or country code. This is 
performed only if target area information is received from the LCS Client. 
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5.4.1 .4 Location Client Zone Transformation Function (LCZTF) 

The Location Client Zone Transformation Function (LCZTF) performs transformations of a location (latitude and 
longitude) into a zone identity, which in North America identifies a particular emergency services zone. 

5.4.2 System handling component 

5.4.2.1 Location System Control Function(LSCF) 

The Location System Control Function (LSCF) is responsible for co-ordinating location requests. This function 
manages call-related and non-call-related positioning requests of LCS and allocates network resources for handling 
them. The LSCF retrieves UE classmark information for the purpose of determining the LCS capabilities of UE. 

The LSCF performs call setup if required as part of a LCS e.g., putting the UE on dedicated radio resources. It also 
caters for co-ordinating resources and activities with regard to requests related to providing assistance data needed for 
positioning. This function interfaces with the LCCF, LSPF, LSBF and PRCF. Using these interfaces, it conveys 
positioning requests to the PRCF, relays positioning data to the LCCF and passes charging related data to the LSBF. 

The U-LSCF for UTRAN is further described in TS 25.305 [1], LSCF for GERAN is described in TS 43.059 [16]. 

5.4.2.2 Location System Billing Function (LSBF) 

The Location System Billing Function (LSBF) is responsible for charging and billing activity within the network related 
to location services (LCS). This includes charging and billing of both clients and subscribers. Specifically, it collects 
charging related data and data for accounting between PLMNs. 

5.4.2.3 Location System Operations Function (LSOF) 

The Location System Operations Function (LSOF) is responsible for provisioning of data, positioning capabilities, data 
related to clients and subscription (LCS client data and UE data), validation, fault management and performance 
management of LCS. 

An LSOF may be associated with each entity. 

5.4.2.4 Location System Broadcast Function (LSBcF) 

The Location System Broadcast Function (LSBcF) provides broadcast capability. The LSBcF capability is only used 
when broadcast data is required for E-OTD, OTDOA or assisted GPS positioning methods. 

5.4.2.5 Location System Co-ordinate Transformation Function (LSCTF) 

The Location System Co-ordinate Transformation Function (LSCTF) provides the conversion of an area definition, 
expressed in a geographic shape as defined in TS 23.032 [11], to network identities recognised only within a PLMN 
(such as Cell Identity, Location Area Identity). The area definition may convert to more than one network identity such 
as a collection of Cell Global Identities. 

5.4.2.6 Location IMS - Interworking Function (LIMS-IWF) 

The Location IMS - Interworking Function (LIMS-IWF) in the requesting network provides the capability to route LCS 
service requests based on an IMS Public User Identity (SIP-URI) to the home network of the target user. The LIMS- 
IWF in the home network of the target user is responsible to determine the appropriate HSS and to obtain the MSISDN 
associated with a IMS Public User Identity fom the HSS. 

5.4.3 Subscriber handling Component 

5.4.3.1 Location Subscriber Authorization Function (LSAF) 

The Location Subscriber Authorization Function (LSAF) is responsible for authorizing the provision of a location 
service (LCS) for a particular mobile station (UE with SIM/USIM). Specifically, this function validates that a LCS can 
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be applied to a given subscriber. In case LCF is in the UE then LSAF verifies that the UE subscriber has subscribed to 
the requested LCS service. LSAF also detects if the identity used to address the target UE is a pseudonym. If the 
identity used is detected as a pseudonym, the LSAF can then call the Location Subscriber Translation Function to 
perform the translation to verinym. 

5.4.3.2 Location Subscriber Translation Function (LSTF) 

The Location Subscriber Translation Function (LSTF) is responsible for the mapping between pseudonyms and 
verinyms of the target UE. 

5.4.3.3 Location Subscriber Privacy Function (LSPF) 

The Location Subscriber Privacy function is responsible performs all privacy related authorizations. For a target UE it 
shall authorize the positioning request versus the privacy options of the target UE, if any. 

5.4.4 Positioning components 

The positioning components Positioning Radio Co-ordination Function (PRCF), Positioning Calculation Function 
(PCF), Positioning Signal Measurement Function (PSMF) and Positioning Radio Resource Management (PRRM) are 
described in documents specific to each Access Network type. 

For location services the Access Network shall send the result of the positioning to the core network in geographical co- 
ordinates as defined in TS 23.032 [11]. The Access Network shall map the cell(s) the Target UE is associated with into 
geographical co-ordinates, but this mapping is not standardized. 

These entities are defined in TS 25.305 [1] for UTRAN and in TS 43.059 [16] for GERAN. 

5.5 Information Flows between Client and Server 

Other types of national specific information flows may be supported in addition to the information flow specified here. 

Any of the information flows here indicated may not be externally realized if the information does not flow over an 
open interface. 

5.5.1 Location Service Request 

Via the Location Service Request, the LCS client communicates with the LCS server to request for the location 
information of one or more than one UE within a specified quality of service. There exist two types of location service 
requests: 

Location Immediate Request (LIR); and 

Location Deferred Request (LDR). 

The attributes for the information exchange between the LCS Client and the LCS Server have been standardized by 
OMA based on requirements set by TS 22.071 and TS 23.271. 

The following attributes are identified for Location Service Request information flow: 

Target UE identity (either verinym or pseudonym); 

- LCS Client identity; 
Service identity, if needed; 

- Response method (SYNC or AS YNC), if needed; 
Codeword, if needed; 

Requestor identity, if needed (and type of Requestor identity if available); 

Number dialled by the target mobile user or APN-NI, if the request is call or session related ; 
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Type of Event definition, i.e. UE available or change of area, applicable to deferred location requests only; 
Definitions for change of area type deferred location requests. Following parameters may be defined, if needed; 

a) Indication for event trigger, i.e. UE enters, leaves or is within requested target area; 

b) Indication of either a single event report or multiple event reports; 

c) Minimum interval time between area event reports, if multiple event reports is requested; 

d) Indication of the requested location estimate; i.e. whether the location estimate of the target UE should be 
contained in the change of area event report; 

Start time, stop time (i.e. specifying the validity time of LCS request), if needed; 

Interval, applicable to periodical requests only; 

Requested Quality of Service information, if needed, i.e. accuracy, response time and LCS QoS Class; 

- Requested type of location, i.e. 'current location', 'current or last known location' or 'initial location' applicable to 
LIR only (current location is only available for LDR); 

Priority, if needed; 

Service coverage (i.e. E.164 country codes for geographic areas [35a]), if needed; 

Requested maximum age of location, if needed; 

Local coordinate reference system, if needed; 

Target area, i.e. geographical area expressed as one of the following format, if needed. 

a) a shape defined in TS 23.032 [1 1] 

b) local coordinate system 

c) E. 164 country code for a geographic area [35a] 

d) PLMN identity 

e) geopolitical name of the area (e.g. London) 

Some of the information may be stored in GMLC and the LCS client does not need to include such information in 
the location service request. 

5.5.2 Location Service Response 

The LCS server (GMLC) sends the Location Service Response to the LCS client either as an: 

Immediate Response; or a 

Deferred Response, these deferred responses can be either single or periodic. 

The following attributes are identified for the Location Service Response information flow: 

Location indication of UE in geographical coordinates expressed as a shape as defined in TS 23.032 [11] or local 
coordinate system; 

The information about the positioning method used to obtain the location estimate of the UE, if it is available at 
the LCS server and if needed; 

Time stamp of location estimate; 

Indication when UE enters, is within or leaves the Geographical area, if needed; 

Acknowledgement for a deferred location request, if needed. 
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Request id, if needed. 
LDR reference number, if needed. 

Indication that the requested QoS was not met, if needed, only applicable if the request was for best effort class 
In addition the information attributes of the location service request may be used also in the location service response. 

5.6 Information Flows between LCS Servers 

Other types of national specific information flows may be supported in addition to the information flow specified here. 

Any of the information flows here indicated may not be externally realized if the information does not flow over an 
open interface. 

When the LCS server"s associated GMLC uses the Lr interface then this interface shall conform to the procedures 
defined in clause 9 of the current specification. 



5.6.1 Location Service Request 



Via the Location Service Request, the source LCS server communicates with the destination LCS server to request for 
the location information of one UE within a specified quality of service. There exist two types of location service 
requests: 

- Location Immediate Request (LIR); and 
Location Deferred Request (LDR). 

The following attributes are identified for Location Service Request information flow: 

- Target UE identity, (either one or both of MSISDN and IMSI, or SIP-URI, or pseudonym); 
LCS Client identity, i.e. LCS client external identity or internal identity; 

LCS Client type, (i.e. Value added. Emergency, PLMN operator or Lawful interception); 
LCS Client name, if needed (and type of LCS client name if available); 
Service type, if needed; 

- Response method (SYNC or AS YNC), if needed; 
Codeword, if needed; 

Requestor identity, if needed (and type of Requestor identity if available); 

Number dialled by the target mobile user or APN-NI, if the request is call or session related ; 

Type of Event definition, i.e. UE available or change of area, applicable to deferred location requests only; 

Definitions for change of area type deferred location requests. Following parameters may be defined, if needed; 

a) Indication for event trigger, i.e. UE enters, leaves or is within requested target area; 

b) Indication of either a single event report or multiple event reports; 

c) Minimum interval time between area event reports; 

d) Start time, stop time, i.e. specifying the validity time of LCS area event request 

Requested Quality of Service information, if needed, i.e. accuracy, response time and LCS QoS Class; 

Requested type of location, i.e. 'current location', 'current or last known location' or 'initial location' applicable to 
LIR only (current location is only available for LDR); 

Priority, if needed; 
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Requested maximum age of location, if needed; 

Privacy override indicator, if needed; 

Service coverage (i.e. E.164 country codes for geographic areas [35a]), if needed; 

Indicator of privacy check related actions, if needed; 

Supported GAD shapes, if needed; 

- HPLMN LCS server address, i.e. H-GMLC address, if needed; 

- VPLMN LCS server address, i.e. V-GMLC address, if needed; 
Network address of Privacy Profile Register, if needed; 
Network numbers of serving nodes; 

LCS capability sets of serving nodes, if needed. 

Target area, i.e. geographical area expressed as one of the following format, if needed. 

a) a shape defined in TS 23.032 [11] 

b) E. 164 country code for a geographic area [35a] 

c) PLMN identity 

LDR reference number, if needed. 



5.6.2 Location Service Response 



The Location Service Response is sent to the source LCS server as the result of the Location Service Request by the 
destination LCS Server: 

Immediate Response; or a 

Deferred Response, these deferred responses can be either single or periodic. 

The following attributes are identified for the Location Service Response information flow: 

Location indication of UE in geographical coordinates expressed as a shape as defined in TS 23.032 [11]; 

Indication when UE enters, is within or leaves the geographical area, if needed; 

The information about the positioning method used to obtain the location estimate of the UE, if it is available at 
the LCS server and needed; 

Age of location estimate; 

Acknowledgement for a deferred location request, if needed. 

Request id, if needed 

Indication that the requested QoS was not met, if needed, only applicable if the request was for best effort QoS 
class 

In addition the information attributes of the location service request may be used also in the location service response. 



LCS Architecture 



Figure 6.1 shows the general arrangement of the Location Service feature in GSM and UMTS. This illustrates, 
generally, the relation of LCS Clients and servers in the core network with the GERAN and UTRAN Access Networks. 
The LCS entities within the Access Network communicate with the Core Network (CN) across the A, Gb and lu 
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interfaces. Communication among the Access Network LCS entities makes use of the messaging and signalling 
capabilities of the Access Network. 

As part of their service or operation, the LCS Clients may request the location information of UE. There may be more 
than one LCS client. These may be associated with the GSM/UMTS networks or the Access Networks operated as part 
of a UE application or accessed by the UE through its access to an application (e.g. through the Internet). 

The clients make their requests to a LCS Server. There may be more than one LCS Server. The client must be 
authenticated and the resources of the network must be co-ordinated including the UE and the calculation functions, to 
estimate the location of the UE and result returned to the client. As part of this process, information from other systems 
(other Access Networks) can be used. As part of the location information returned to the client, an estimate of the 
accuracy of the estimate and the time-of-day the measurement was made may be provided. 



* Note 2 

Tl. Proprietary 




NOTE 1 : HSS includes botli 2G-HLR and 3G-HLR functionality. LCS is included in the overall network architecture 
in TS 23.002 [20]. 

NOTE 2: As one alternative the LCS client may get location information directly from GMLC, which may contain OSA 
Mobility SCS with support for the OSA user location interfaces. See TS 23.127 [26] and TS 29.198 [27, 28, 
29 and 30). 



NOTE 3 
NOTE 4 
NOTES 



The PPR functionality may be integrated in GMLC 

The PMD functionality may be integrated in GMLC or PPR. 

The LIMS-IWF may optionally be located within the GMLC. 

Figure 6.1-1 : General arrangement of LCS 
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Figure 6.1-2: General arrangement of LCS with inter-GMLC and LIMS-IWF [Lr] interface 

6.1 Schematic functional description of LCS operations 

The allocation of LCS functional blocks to the Client, LCS server, Core Network, Access Network and UE is based on 
the schematic functional description below. The detailed functions and interactions are specified later in the present 
document and in TS 25.305 [1] for UTRAN, in TS 43.059 [16] for GERAN and in corresponding Stage 3 
specifications. 

The operation begins with a LCS Client requesting location information for a UE from the LCS server. The LCS server 
will pass the request to the LCS functional entities in the core network. The LCS functional entities in the core network 
shall then: 

verify that the LCS Client is authorized to request the location of the UE or subscriber; 

verify that LCS is supported by the UE; 

establish whether it is allowed to locate the UE or subscriber, for privacy or other reasons; 

establish which network element in the Access Network should receive the Location request; 

request the Access Network (via the A, Gb or lu interface) to provide location information for an identified UE, 
with indicated QoS; 

receive information about the location of the UE from the Access Network and forward it to the Client; 

send appropriate accounting information to an accounting function. 

The Access Network LCS functional entities shall determine the position of the target UE according to TS 25.305 [1] 
for UTRAN and TS 43.059 [16] for GERAN. 



6.2 



Allocation of LCS functions to network elements 



Table 6.1 shows a summary of the Functional Groups and Functional Blocks for Location services. Table 6.2 and 
figure 6.2 show the generic configuration for LCS and the distribution of LCS functional blocks to network elements. 
Different positioning methods, including network-based, mobile-based, mobile-assisted and network-assisted 
positioning methods may be used. With this configuration both the network and the mobiles are able to measure the 
timing of signals and compute the mobile's location estimate. Depending on the applied positioning method it is 
possible to utilise the corresponding configuration containing all needed entities. For instance, if network-based 
positioning is applied, the entities that are involved in measuring the mobile's signal and calculating its location estimate 
are allocated to the network elements of the access stratum. On the other hand, in case mobile-based or network-assisted 
methods are used these entities should be allocated to the UE. 
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LCS is logically implemented on the network structure through the addition of one network node, the Mobile Location 
Center (MLC). It is necessary to name a number of new interfaces. The LCS generic architecture can be combined to 
produce LCS architecture variants. 

Table 6.1 : Summary of Functional Groups and Functional Blocks for Location services 



Funct. 
Group 


Functional 
component 


Full name of Functional Block 


Abbrev. 


Loc. 
Client 


Location Client 
Component 


(External) Location Client Function 


LCF 


Internal Location Client Function 


LCF 
-internal 






LCS 

Server 

in PLMN 


Client handling 
component 


Location Client Control Function 


LCCF 


Location Client Authorization Function 


LCAF 


Location Client Co-ordinate Transformation Function 


LCCTF 


Location Client Zone Transformation Function 


LCZTF 


System handling 
component 


Location System Control Function 


LSCF 


Location System Billing Function 


LSBF 


Location System Operations Function 


LSOF 


Location System Co-ordinate Transformation Function 


LSCTF 


Location IMS - Interworking Function 


LIMS-IWF 


Subscr. 

Handling 

component 


Location Subscriber Authorization Function 


LSAF 


Location Subscriber Privacy function 


LSPF 


Positioning 
component 


Positioning Radio Control Function 


PRCF 


Positioning Calculation Function 


PCF 


Positioning Signal Measurement Function 


PSMF 


Positioning Radio Resource Management 


PRRM 



Table 6.2 and figure 6.2 illustrate the allocation of functional entities in the reference configuration of LCS. It is 
assumed that the CS and PS have either their own independent mobility management or use the joint mobility 
management through the optional Gs interface. 

It is also seen that LCS may take benefit of the lur interface between RNCs, when uplink radio information and 
measurement results are collected. 

The functional model presented in the figure includes functional entities for both CS and PS related LCS. In addition, it 
consists of all the entities needed for different positioning methods, i.e. network based, mobile based, mobile assisted, 
and network assisted positioning, exploiting either uplink or downlink measurements. It is noted that the UE may use 
e.g. the GPS positioning mechanism, but still demand e.g. auxiliary measurements from the serving network. RAN 
specific functional entities are specified in TS 25.305 [1] for UTRAN and in TS 43.059 [16] for GERAN. 
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Table 6.2: Allocation of LCS functional entities to network elements 





UE 


RAN 


GMLC 


SGSN 


MSC/MSC 
Server 


HLR/HSS 


PPR 


PMD 


Client 


Location client functions 


LCF 


X 






X 


X 








X 


LCF 
Internal 




X 
















Client handling functions 


LCCTF 






X 














LCCF 






X 














LCAF 






X 














LCZTF 






X 














System handling functions 
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X 




X 
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LSBF 






X 


X 
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LSOF 


X 


X 


X 


X 


X 
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X(Note 1) 














Subscriber handling functions 


LSAF 






X 


X 


X 




X 






LSPF 






X 


X 


X 


X 


X 






LSTF 
















X 




Positioning functions 


PRCF 




X 
















PCF 


X 


X 
















PSMF 


X 


X 
















PRRM 




X 
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Note 1 : The LIMS-IWF may optionally be located within the GIVILC. If it is not located within the GMLC, it shall use 
the Le or Lr reference point to interface to the GIVILC. 



^^ 



Cpcf) 

UE 



I 
Um/Uu 




A/lu 




See Note 1 



Note 1 : 



Figure 6.2: Generic LCS Logical Architecture 

The LIIVIS-IWF may optionally be located within the GI\/ILC. If it is not located within the GI\/ILG, it shall use 
the Le or Lr reference point to interface to the GI\/ILC. 



6.3 Functional description of LCS per network element 

6.3.1 Access Network 

The Access Network is involved in the handling of various positioning procedures. 

The LCS specific functionalities of the radio access network elements are specified in TS 25.305 [1] for UTRAN and 
TS 43.059 [16] for GERAN. 

6.3.2 LCS Clients, LCS applications and Requestors 

There are two classes of LCS Application - Internal applications and External applications. Internal applications 
represent entities internal to the GSM/UMTS that make use of location information for the (improved) operation of the 
network. Internal LCS client can be identified by LCS client internal ID. LCS client Internal ID distinguishes the 
following classes: (LCS cUent broadcasting location related information, O&M LCS client in the HPLMN, O&M LCS 
client in the VPLMN, LCS client recording anonymous location information, LCS Client supporting a bearer service, 
teleservice or supplementary service to the target UE). External applications represent entities (such as Commercial or 
Emergency services) that make use of location information for operations external to the mobile communications 
network. External LCS client can be identified by LCS client external ID. The LCS Applications interface to the LCS 
entities through their Location Client functions (LCF). Location requests from the external LCS clients may be 
originated by external entities (i.e. Requestor). LCS client should authenticate the Requestor Identity but this is outside 
the scope of this specification. 
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LCS client may indicate the type of the Requestor identity in the LCS service request. The type of the Requestor 
identity can be one of the following: 

• Logical name 

• MSISDN [17] 

• E-mail address [33] 

• URL [33] 

• SIP URL [34] 

• IMS pubUc identity [35] 

The LCS Client, LCS applications and Requestors are outside the scope of the present document. 

6.3.3 Gateway Mobile Location Center, GMLC 

The Gateway Mobile Location Center (GMLC) contains functionality required to support LCS. In one PLMN, there 
may be more than one GMLC. 

A GMLC is the first node an external LCS client accesses in a PLMN (i.e. the Le reference point is supported by the 
GMLC). The GMLC may request routing information from the HLR or HSS via the Lh interface. After performing 
registration authorization, it sends positioning requests to either VMSC, SGSN or MSC Server and receives final 
location estimates from the corresponding entity via Lg interface. Information needed for authorisation, location service 
requests and location information may be communicated between GMLCs, located in the same or different PLMNs, via 
the Lr interface. The target UE"s privacy profile settings shall always be checked in the UE"s home PLMN prior to 
delivering a location estimate. In order to allow location request from a GMLC outside the HPLMN while having 
privacy check in the HPLMN, the Lr interface is needed. 

The 'Requesting GMLC is the GMLC, which receives the request from LCS client 

The 'Visited GMLC is the GMLC, which is associated with the serving node of the target mobile. 

The 'Home GMLC is the GMLC residing in the target mobile" s home PLMN, which is responsible for the control of 
privacy checking of the target mobile. 

The Requesting GMLC can be the Visited GMLC, and either one or both of which can be the Home GMLC at the same 
time. 



6.3.4 LCS support in tine UE 



The UE may be involved in the various positioning procedures. Specific UE involvement is specified in each of the 
positioning procedures specified in TS 25.305 [1] for UTRAN and TS 43.059 [16] for GERAN. 

The UE interacts with the measurement co-ordination functions to transmit the needed signals for uplink based LCS 
measurements and to make measurements of downlink signals. The measurements to be made will be determined by the 
chosen location method. 

The UE may also contain LCS applications, or access a LCS application through communication with a network 
accessed by the UE or an application residing in the UE. This application may include the needed measurement and 
calculation functions to determine the UE's location with or without assistance of the GSM/UMTS LCS entities. 

In GSM the positioning methods supported by the UE are signalled by the UE to the core network and radio access 
network using Classmark3 in CS mode, as specified in TS 24.008 [24]. 

In UMTS the UE capability to support different positioning methods is only communicated within UTRAN, as 
specified in TS 25.331 [25]. 

The UE informs the core network about its capability to support privacy invocation request and response using 
Classmark2 in CS mode and MS Network Capability in PS mode, as specified in TS 24.008 [24]. 



£75/ 



3GPP TS 23.271 version 6.1 0.0 Release 6 34 ETSI TS 1 23 271 V6.1 0.0 (2004-1 2) 

The UE may also, for example, contain an independent location function (e.g. Global Satellite Positioning Service GPS) 
and thus be able to report its location, independent of the RAN transmissions. The UE with an independent location 
function may also make use of information broadcast by the RAN that assists the function. 

6.3.5 MSC/VLR 

The MSC/VLR contains functionality responsible for UE subscription authorization and managing call-related and 
non-call related positioning requests of LCS. The MSC is accessible to the GMLC via the Lg interface. The LCS 
functions of MSC are related to charging and billing, LCS co-ordination, location request, authorization and operation 
of the LCS services. If connected to SGSN through the Gs interface, it checks whether the UE is GPRS attached to 
decide whether to page the UE on the A/Iu or Gs interface. 

The MSC/VLR may inform HLR/HSS about the UE"s LCS Capabilities and may include the IP address of the V- 
GMLC associated with the MSC/VLR in the MAP UPDATE LOCATION message, during Registration and Inter MSC 
Update Location procedures. 

6.3.6 MSC Server 

The MSC Server handles the same functionality as the MSC/VLR including charging and billing, LCS co-ordination, 
location request, authorization and operation of the LCS services. The MSC Server is accessible to the GMLC via the 
Lg interface. 

6.3.7 SGSN 

The SGSN contains functionality responsible for UE subscription authorization and managing positioning requests of 
LCS. The SGSN is accessible to the GMLC via the Lg interface. The LCS functions of SGSN are related to charging 
and billing, LCS co-ordination, location request, authorization and operation of the LCS services. 

The SGSN may inform HLR/HSS about the UE"s LCS Capabihties for GPRS and may include the IP address of the V- 
GMLC associated with the SGSN in the MAP UPDATE GPRS LOCATION message, during Attach and Inter SGSN 
Routing Area Update procedures. 

The SGSN forwards the circuit-switched paging request received from the Gs interface to the BSS/RNC. 

6.3.8 Home Location Register, HLR 

The HLR contains LCS subscription data and routing information. The HLR is accessible from the GMLC via the Lh 
interface. For a roaming UE, HLR may be in a different PLMN. 

6.3.9 HSS 

The HSS contains LCS subscription data and routing information. The HSS is accessible from the GMLC via the Lh 
interface. For roaming UEs, HSS may be in a different PLMN. 



6.3.10 gsmSCF 

The Lc interface supports CAMEL access to LCS and is applicable only in CAMEL [phase 3?]. The procedures and 
signaling associated with it are defined in TS 23.078 [21] and TS 29.002 [18], respectively. 

6.3.1 1 Privacy Profile Register, PPR 

Privacy check may be done in the privacy profile register. The HLR or HSS contains the address to the PPR. The PPR 
is accessible from the H-GMLC via the Lpp interface. PPR may be a standalone network entity or the PPR functionality 
may be integrated in H-GMLC. 
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6.3.12 Pseudonym Mediation Device, PMD 

The pseudonym mediation device (PMD) functionality maps or decrypts the pseudonym into the corresponding 
verinym (i.e. IMSI or MSISDN). PMD functionality may be a standalone network entity or the PMD functionality may 
be integrated in PPR, GMLC or other network entity. If PMD functionality is not part of GMLC it may be accessed 
using the Lid interface. The detail of PMD functionality is out of scope, and only the interface between GMLC and 
PMD functionality is specified in this specification. 

6.4 Addressing the target UE for LCS purposes 



6.4.1 Verinyms for tine target UE 



It shall be possible to address and indicate the target UE using MSISDN and SIP-URL It may be possible in certain 
cases to address the target UE using IP address when a static or dynamic IP address (IPv4 or IPv6) has been allocated 
for the UE. 

In the mobile terminated location request procedures in the PS domain (as well as in the CS domain), the target UE is 
identified using either MSISDN or IMSI. 

NOTE: It is recognized that IP-addressing of the target UE is only possible when there is an active PDP context 
established between the target UE and the external LCS client. Using the established PDP context, the 
LCS client can request the target UE, as identified with the IP address it currently uses, to initiate a 
Mobile originated location request. The actual signaling exchange between the LCS Client/server and the 
target UE or the user of the target UE is outside the scope of this specification. The resulting MO-LR is 
performed as specified in this document. 

6.4.2 Pseudonyms for tine target UE 

National regulations require support for the anonymity of the target mobile user in some countries. It shall therefore be 
possible to address and indicate the target UE using a pseudonym. The pseudonym may be the IMSI or MSISDN of the 
target UE encrypted e.g. using the public key of the home operator. The address of the network element that issued the 
pseudonym, i.e. the PMD address, shall either be attached to the pseudonym, if required or this address can be deduced 
from the pseudonym. The H-GMLC address may also either be attached to the pseudonym or be deduced from the 
pseudonym. It is outside the scope of this specification how the requestor and the LCS client will receive and handle the 
pseudonym, but some examples are described in the informative Annex E. 

6.4.3 Non-dialable callback numbers 

In case of a SIM -less emergency call, a non-dialable callback number shall be used to identify the target UE. The 
format and structure of the non-dialable callback number is according to national or regional regulations. The non- 
dialable callback number in North America shall, according to J-STD-036 [32], be the digits 91 1 H- the last 7 digits of 
IMEI expressed in decimal numbers. 

Editorial note: The use of non-dialable callback numbers in other parts of the world is for further study. The non- 
dialable callback number should adopt random numbering, if not otherwise unique. 

6.5 Quality of Service Information 

LCS Quality of Service information is characterised by 3 key attributes: 

- LCS QoS Class 

Accuracy 

Response Time 

The use of quality of service to characterise location requests is optional and if not requested the default shall be either 
network operator determined or client negotiated. 
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6.5.1 LCSQoS Class 

The LCS QoS Class defines the degree of adherence by the Location Service to another quahty of service parameter 
(Accuracy), if requested. The LCS Server shall attempt to satisfy the other quality of service parameter regardless of the 
use of QoS Class. 

6.5.1.1 Best Effort Class 

This class defines the least stringent requirement on the QoS achieved for a location request. If a location estimate 
obtained does not fulfil the other QoS requirements, it should still be returned but with an appropriate indication that the 
requested QoS was not met. If no location estimate is obtained, an appropriate error cause is sent. 

6.5.1.2 Assured Class 

This class defines the most stringent requirement on the accuracy achieved for a location request. If a location estimate 
obtained does not fulfil the other QoS requirements, then it shall be discarded and an appropriate error cause sent. 



7 Signaling and Interfaces 

7.1 LCS signaling between Access and Core Networks 

The core network sends location requests to the access network, which then sends the corresponding responses back to 
the core network. 

Communication between access and core networks is accomplished through lu interface in UMTS whereas the A, Gb 
and lu interfaces are used for the purpose in GSM (see TS 25.305 [1] and TS 43.059 [16]). 

7.1 .1 Core network Location Request 

The core network request for a location estimate of a target UE shall contain sufficient information to enable location of 
the Target UE according to the required QoS using any positioning method supported by the PLMN and, where 
necessary, UE. For location services the core network may request the geographical co-ordinates of the Target UE. 

In lu mode the core network may also request in which Service Area the Target UE is located. The Service Area 
information may be used for routing of corresponding Emergency calls, or for CAMEL services. 

In A/Gb mode this corresponds to the usage of Cell ID in the core network.lt should be noted that the Service Area 
concept is different from the Localized Service Area concept used for SoLSA services. 

When the location of a Target UE in Idle Mode is requested, the core network shall determine which RAN entity is 
associated with the Target UE. 

7.1.2 Location Report 

The access network reports the location of the Target UE to the core network entities. The location report may contain the 
following information as defined in the corresponding location request: 

the geographical co-ordinates of the Target UE; 

the positioning method used to obtain the location estimate if the access network is either GERAN in the A/Gb 
mode, GERAN in the lu mode or UTRAN in the lu mode. 

the service area in which the Target UE is located; 

achieved quality level of the location estimate. 
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7.2 Um and Uu Interfaces 

The Um and Uu interfaces are used to communicate among the LCS entities associated with the BSC and RNC, the UE 
and the stand-alone Location Measurement Units (LMU). The Um and Uuinterfaces are also used to communicate 
between the LCS entities in the core network and the UE. 

The Um/Uu interfaces may pass measurement requests and results to and from UE or the stand-alone LMU. 

The Um/Uu interfaces may also pass location requests from internal or external LCS Clients (Applications) at the UE. 
Note that these requests may require the services of the LCS entities associated with the core network to authenticate 
clients and subscriber subscriptions to aspects of the LCS. 

The Um/Uu interfaces may also be used for broadcast of information that may be used by the UE or stand-alone LMU 
for their LCS operations. This may, for example, include timing information about nearby Node-B/BTS transmissions 
that may assist the UE or LMU in making their measurements. In UTRAN code information may be included. 

The Um and Uu interfaces may also pass messages relating to changes or reporting of the data associated with the 
Location System Operations Function (LSOF) in the UE or the remote LMU. 

UTRAN Stage 2 specification TS 25.305 [1] specifies LCS signalling over the Uu interface and GERAN Stage 2 
specification TS 43.059 [16] over the Um interface correspondingly. 

Message segmentation is specified in GERAN LCS Stage 2, TS 43.059 [16]. 

7.3 MAP Interfaces 

The following interfaces are based on MAP in LCS. 

Lh interface: interface between GMLC and HSS. This interface is used by the GMLC to request the address of 
the H-GMLC, and/or the address of the visited MSC or SGSN for a particular target UE whose location has been 
requested 

- Lg interface: interface between GMLC MSC and GMLC - SGSN. This interface is used by the GMLC to convey 
a location request to the MSC or SGSN currently serving a particular target UE whose location was requested. 
The interface is used by the MSC or SGSN to return location results to the GMLC. 

Lc interface: interface between GMLC and gsmSCF, CAMEL. This interface is used to get location information 
for CAMEL based services. 

The following MAP services are defined for LCS. 

- MAP-SEND-ROUTING-INFO-FOR-LCS Service. 

This service is used between the GMLC and the HLR/HSS to retrieve the routing information needed for routing a 
location service request to the serving VMSC , SGSN. The service may be used in GMLC - HSS interface to retrieve 
routing information in order to route the location service request to the correct VMSC, SGSN and MSC Server. 

In case the service is used between the R-GMLC and the HSS, the H-GMLC address of the target UE to be located is 
retrieved. The address of the V-GMLC associated with the serving node and PPR may also be retrieved. 

- MAP-PROVIDE-SUBSCRIBER-LOCATION Service. 

This service is used by a GMLC to request the location of a target UE from the visited MSC, SGSN or MSC Server at 
any time. 

- MAP-SUBSCRIBER-LOCATION-REPORT Service. 

This service is used by a VMSC, SGSN or MSC Server to provide the location of a target UE to a GMLC when a 
request for location is either implicitly administered or made at some earlier time. 

The MAP Subscriber Location Report could also be used to send information about location of the Target UE (for 
MO-LR) to an external client. 
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7.4 Lpp interface 



Lpp is the interface between H-GMLC and PPR. If the UE subscribers LCS privacy information is kept in the PPR this 
interface is used by the H-GMLC to request the PPR to perform a privacy check. The Lpp interface shall conform to the 
protocol as specified in (reference to be added) and the procedures defined in clause 9 of this specification. 



7.4.1 LCS Authorisation Request 



Via the LCS Authorisation Request, the H-GMLC can request the PPR to perform the privacy check. There exist two 
types of LCS Authorisation Request: 

LCS Authorisation Request without location estimate (send by H-GMLC before location request); 

LCS Authorisation Request with location estimate (to check location related privacy settings). 

The following attributes are identified for LCS Authorisation Request information flow: 

- Target UE identity, (one or both of MSISDN and IMSI), if needed; 

If PPR contains PMD functionality the LCS Authorisation Request may contain the same information as the 
LCS Identity request, i.e. the pseudonym of the target UE, if needed. 

Indication on call/session related MT-LR; 

LCS Client identity, i.e. LCS client external identity or internal identity; 

LCS Client type, (i.e. Value added. Emergency, PLMN operator or Lawful interception); 

LCS Client name, if needed (and type of LCS client name if available); 

Service type, if needed; 

Codeword, if needed; 

Requestor identity, if needed (and type of Requestor identity if available); 

Type of location, i.e. 'current location', 'current or last known location' or 'initial location'; 

LCS capability sets of serving nodes, if needed; 

Location estimate, if needed and available (This is only relevant for LCS Authorisation Request with location 

estimate). 



7.4.2 LCS Autinorisation Response 



The LCS Authorisation Response is sent by the PPR to the H-GMLC as the result for the LCS Authorisation 
Request. 

The following attributes are identified for the LCS Authorisation Response information flow: 

Indicator for location request is to be barred, if needed. If this is set, no other indicators shall be included in the 
response; 

Indicator for call/session related class of privacy check related actions, if needed; 

positioning not allowed; 

positioning allowed without notifying the UE user; 

positioning allowed with notification to the UE user; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 
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positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

Indicator for call/session unrelated class of privacy check related actions, if needed; 

positioning not allowed; 

positioning allowed without notifying the UE user; 

positioning allowed with notification to the UE user; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 

UE user. 

Pseudo external ID, if needed (see Annex C); 

Indicator on additional privacy check with location estimate, if needed; 

Same information as in the LCS Identity Response, in case the PMD is integrated in PPR, if needed. 

7.4.3 LCS Privacy Profile Update notification 

The LCS Privacy Profile Update notification is sent to the H-GMLC from the PPR in order to notify the H-GMLC 
about the change of UEs privacy profile. 

- Target UE identity, (one or both of MSISDN and IMSI); 
Indication on the changed UEs privacy profile 

7.4.4 LCS Privacy Profile Update notification ack 

The LCS Privacy Profile Update notification ack. is sent to the PPR as the result of the LCS Privacy Profile Update 
Request by H-GMLC. 

Acknowledgement 

7.5 Lid interface 

Lid is the interface between H-GMLC and PMD. If the UE subscribers pseudonym can be mapped or decrypted to the 
corresponding verinym in the standalone PMD. The Lid interface shall conform to the protocol as specified in 
(reference to be added) and the procedures defined in clause 9 of this specification. 

7.5.1 LCS Identity Request 

Via the LCS Identity Request, the H-GMLC can request the PMD to retrieve the verinym of the subscriber. 
The following attribute is identified for the LCS Identity Request: 

- Pseudonym; 

7.5.2 LCS Identity Response 

The PMD sends the LCS Identity Response to the H-GMLC as a result of the LCS Identity Request by the H-GMLC. 
The following attribute is identified for the LCS Identity Response information flow: 

- Target UE identity, (one or both of MSISDN and IMSI); 
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7.6 IMS related Interfaces 

7.6.1 Dh Interface 

Dh is the interface between LIMS-IWF and SLF. The purpose of this interface is to retrieve the address of the correct 
HSS serving the user. Dh is an optional interface. 

7.6.2 Sh Interface 

Sh is the interface between LIMS-IWF and HSS. The purpose of this interface is to retrieve the user"s MSISDN. 

8 General network location procedures 

8.1 State description for GMLC 
8.1.1 GMLC states 

8.1.1.1 NULL state 

In the NULL state, a particular location request from some LCS client either has not been received yet or has already 
been completed. After a location request is received from a LCS client, the GMLC remains in the NULL state while the 
identity of the client and nature of its location request are verified. While the NULL state exists conceptually, it need 
not be represented explicitly in the GMLC. 

8.1 .1 .2 INTERROGATION State 

In this state, the GMLC has sent an interrogation to the home HLR/HSS of the UE to be located and is awaiting a 
response giving one or several of the following addresses:the VMSC, MSC Server, SGSN address and IMSI for this 
UE. 

8.1.1.3 LOCATION State 

In this state, the GMLC has sent a location request to the VMSC, MSC Server or SGSN serving the UE to be located 
and is awaiting a response containing a location estimate. Optionally, location information may also be communicated 
between GMLCs, located in the same or a different PLMN, via the GMLC to GMLC Lr interface 
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8.1.2 State functionality 
8.1.2.1 State Transitions 



Location Request - 
Interrogate HLR/HSS 
for 
VGMLXTVMSC/SGSN/MSj 
Server address 





Location Request - 

GMLC knows VGMLCTVMS 

/SGSN/MSC Server 

address 



Receive 

Location or 

Timeout or 

Error 



Receive 
VGMLCyVMSaSGSN/MSC 
Server address from 
HLR«SS 




Figure 8.1 : State Transitions in the GIVILC 

Moving from NULL to INTERROGATION state: 

If the GMLC does not know any of the following addresses: VMSC, MSC Server, SGSN,V-GMLC address or IMSI 
when it receives a location service request from some LCS client, it moves from the NULL state to the 
INTERROGATION state and sends a request to the UE's home HLR/HSS for the VMSC/ MSC Server/ SGSN/V- 
GMLC address and IMSI. 

Moving from NULL to LOCATION state: 

If the GMLC already knows one of the following addresses: VMSC, MSC Server, SGSN or UE IMSI, when it receives 
a location service request from some LCS client (e.g. from information retained for an earlier location request for the 
same UE), it moves from the NULL state to the LOCATION state and sends a location request to either the VMSC, 
MSC Server or SGSN. Optionally, it may send the location request to another GMLC via the Lr interface. 

NOTE: It is for further study how GMLC selects if it shall send the location request to VMSC, MSC server 
and/or SGSN in different cases. This should be specified in the signalling procedures. 

Moving from INTERROGATION to LOCATION state: 

After the GMLC, in the INTERROGATION state, receives one or several of the addresses VMSC, MSC Server, SGSN, 
V-GMLC and IMSI from the home HLR/HSS, it enters the LOCATION state and sends a location request to either the 
VMSC, MSC Server, SGSN or V-GMLC of the UE being located. 

Moving from LOCATION to NULL state: 

After the GMLC receives a location estimate response from the VMSC, MSC Server, SGSN or V_GMLC, it forwards 
the location estimate to the requesting LCS client and re-enters the NULL state. 



8.1.2.2 



INTERROGATION Timer Function 



The GMLC runs a timer while in the INTERROGATION state to limit the amount of time waiting for an interrogation 
response from the HLR/HSS. If the timer expires before an interrogation response is received, the GMLC indicates a 
location failure to the LCS chent and re-enters the NULL state. 



8.1.2.3 



LOCATION Timer Function 



The GMLC runs a timer while in the LOCATION state to limit the amount of time waiting for a location estimate 
response from the VMSC/ MSC Server /SGSN. If the timer expires before a response is received, the GMLC indicates a 
location failure to the LCS client and re-enters the NULL state. 
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8.2 State description for VIVISC and IVISC Server 
8.2.1 VIVISC and MSC Server States 



8.2.1.1 



LCS IDLE State 



In this state, the VMSC/MSC Server location service is inactive for a particular UE. The UE may be known in the 
VMSC/MSC Server (except for a USIM less or SIM less Emergency call or where the UE information has been 
cancelled or lost in the VMSC/MSC Server), but there may not be an active Mobility Management to the UE. 

8.2.1.2 LOCATION State 

In this state, the VMSC/MSC Server is awaiting a response from RAN after requesting the location for a particular UE. 

8.2.2 State Functionality 
8.2.2.1 state Transitions 



Request 
Location fromy / 
the RAN ^ 




Receive 
Location 
results from the 
RAN or 
Timeout 



Transfer 
Positioning 

Messages 

Figure 8.2: State Transitions in thie VIVISC/IUISC Server 

Moving from LCS IDLE to LOCATION state: 

After a request has been received to locate a particular UE and the UE subscription options have been verified, a 
location request is sent to the RAN of the UE to be located: the VMSC/MSC Server then enters the LOCATION state. 
Before entering this state, the VMSC/MSC Server must have setup a Mobility Management connection to the UE if 
none was previously active. The mobile is paged and authenticated before positioning. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location estimate result from RAN, the VMSC/MSC Server shall re-enter IDLE state. 



8.2.2.2 



LOCATION Timer Function 



The VMSC/MSC Server runs a timer while in the LOCATION state to limit the amount of time waiting for a location 
response from the RAN. If the timer expires before such information is received, the VMSC/MSC Server indicates a 
location failure to the original requesting entity and re-enters IDLE state. 
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8.3 LCS state description for SGSN 
8.3.1 SGSN States 



8.3.1.1 



LCS IDLE State 



In this state, the SGSN location service is inactive for a particular UE. The UE is known in the SGSN except in case 
where the UE data has been cancelled or lost in the SGSN. There is not an active Mobility Management to the UE. 



8.3.1.2 



LOCATION State 



In this state, the SGSN is awaiting a response from the RAN after requesting the location for a particular UE. In this 
state, a Mobility Management connection to the target UE will be active. 

8.3.2 State Functionality 
8.3.2.1 state Transitions 
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Figure 8.3: State Transitions in the SGSN 

Moving from LCS-IDLE to LOCATION state: 

After a request has been received to locate a particular UE and the UE subscription options have been verified to allow 
this, the SGSN sends a location request to the RAN. The SGSN then enters the LOCATION state. Before entering this 
state, the SGSN must have setup a Mobility Management connection to the UE if none was previously active. The 
mobile is paged and authenticated before positioning. 

Moving from LOCATION to LCS IDLE state: 

After the return of a location estimate result from RAN, or if the Location Timer described below expires, the SGSN 
shall re-enter IDLE state. 



8.3.2.2 



LOCATION Timer Function 



The SGSN runs a timer while in the LOCATION state to limit the amount of time waiting for a location response from 
the RAN. If the timer expires before such information is received, the SGSN indicates a location failure to the original 
requesting entity and re-enters IDLE state. 
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8.4 Signaling connection for the lu interface 

When using the lu interface, before SGSN/MSC server can request location information of a target UE from RAN, an 
lu signaling connection must have been established between SGSN/MSC server and RAN. The SGSN/MSC server 
sends a location request message to RAN, which determines the location of the target UE related to this lu signaling 
connection and sends a location report to SGSN/MSC server over the same lu signaling connection. 

8.5 Signaling connection for the A-interface 

When using the A interface, before MSC can request location information of a target UE from RAN, an A interface 
signaling connection must have been established between MSC and RAN. The MSC sends a location request message 
to RAN, which determines the location of the target UE related to this A interface signaling connection and sends a 
location report to MSC over the same A interface signaling connection. 

8.6 Gb interface mapping of target UE 

The pre-requisite for LCS procedures on the Gb interface is that UE is in "ready state". 



9 General Network Positioning Procedures 

The generic network positioning procedure of providing the location information of an UE subscriber can be partitioned 
into the following procedures. 

Location Preparation Procedure 

This generic procedure is concerned with verifying the privacy restrictions of the UE subscriber, reserving network 
resources, communicating with the UE to be located and determining the positioning method to be used for locating the 
UE subscriber based on the requested QoS and the UE and network capabilities. 

Positioning Measurement Establishment Procedure 

This procedure is concerned with performing measurements by involving the necessary network and/or UE resources. 
Depending on the positioning method to be used for locating the UE the internals of this procedure can be positioning 
method dependent. The procedure is completed with the end of the positioning measurements. 

Location Calculation and Release Procedure 

This generic procedure is initiated after the measurements are completed and is concerned with calculating the location 
of the UE and releasing all network and/or UE resources involved in the positioning. 

9.1 Mobile Terminating Location Request 

The MT-LR procedures for the location request from the LCS client which does not have the privacy override 
capability are described in the chapter 9.1.1. 

The MT-LR procedures for the location request from the LCS client which has the privacy override capability (e.g. the 
request is come from the emergency service provider) are described in the chapter 9.1.1A. In this case the H-GMLC is 
not involved to the location procedures and the privacy check procedures in H-GMLC/PPR are skipped. 

It is noted that R-GMLC handles the periodicity of location requests as requested by the LCS client both in CS and PS 
domain. 
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9.1 .1 Common MT-LR procedure in PS and CS domain 
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Figure 9.1 : General Network Positioning for a MT-LR 

1) An external LCS client requests the current location of a target UE from a GMLC. The LCS Client may also 
request a deferred location request, i.e. based on event. The R-GMLC verifies the identity of the LCS client and 
its subscription to the LCS service requested and derives the MSISDN or IMSI or pseudonym of the target UE to 
be located and the LCS QoS from either subscription data or data supplied by the LCS client. For a call related 
location request, the LCS client includes the LCS client's called party number, as dialled by the target mobile 
user, in the LCS service request. For a session related location request, the LCS client includes the APN-NI of 
the LCS client, as used by the target UE, in the LCS service request. For a call/session related request the R- 
GMLC may verify that the called party number or APN-NI is correct for the LCS client in question. The LCS 
client" s dialled number or APN-NI are checked in step 9 for the call/session related class. 
The LCS request may carry also the Service Identity and the Codeword and the service coverage information. 
The R-GMLC may verify that the Service Identity received in the LCS request matches one of the service 
identities allowed for the LCS client. If the service identity does not match one of the service identities for the 
LCS client, the R-GMLC shall reject the LCS request. Otherwise, the R-GMLC can map the received service 
identity in a corresponding service type. 

If the location request is originated by a Requestor, the Requestor Identity may be added to the LCS service 
request. The LCS client should authenticate the Requestor Identity but this is outside the scope of this 
specification. The LCS service request may also contain the type of the Requestor identity if the requestor 
identity was included. 

If the H-GMLC address is not contained in the pseudonym or cannot deduced from the pseudonym, the R- 
GMLC shall determine the verinym for the pseudonym. In this case the R-GMLC may access to its associated 
PMD as described in 9.LL3. 

The R-GMLC verifies whether it stores the privacy profile of the target UE. If the R-GMLC stores the UE"s 
privacy profile, (this means the R-GMLC is the H-GMLC of the target UE), then step 2, 3, 4 and 12 are skipped. 
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If location is required for more than one UE, or if periodic location is requested, the steps following below may 
be repeated. In case the location is requested for more than one UE, the R-GMLC should verify whether the 
number of Target UEs in the LCS request is equal or less than the Maximum Target UE Number of the LCS 
client. If the Maximum Target UE Number is exceeded, the R-GMLC should respond to the client with proper 
error cause. 

2) If the R-GMLC already knows, (e.g. from a previous location request or an internal lookup table), or is able to 
determine, (e.g. it is possible to use a DNS lookup mechanism similar to IETF RFC 2916), the network address 
of H-GMLC of the target UE, or in case the location service request contains the target UE"s pseudonym, which 
includes the target UE"s Home-GMLC address, or a pseudonym from which the target UE"s Home-GMLC 
address can be deduced, then this step and step 3 may be skipped. 

Otherwise, the R-GMLC sends a SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the 
target UE to be located with the IMSI or MSISDN of the UE. 

The details of the alternative methods of retrieving H-GMLC address other than the sending 
SEND_ROUTING_INFO_FOR_LCS message to the HLR/HSS, (e.g. internal lookup table, DNS lookup 
mechanism), are not in the scope of this specification. 

Editor's note: The support for number portability with these alternative solutions of retrieving H-GMLC address 
still needs further study and should be in line with the general solution to support number 
portability in Rel-6. 

3) The HLR/HSS verifies whether the R-GMLC is authorized to request UE location information. If not, an error 
response is returned. 

Otherwise the HLR/HSS returns one or several of the network addresses of the current SGSN and/or 
VMSC/MSC server, the LCS capabilities of the serving nodes if available , the V-GMLC address associated 
with the serving nodes, if available and whichever of the IMSI and MSISDN that was not provided in step 2. The 
HLR/HSS returns the address of the H-GMLC. The HLR/HSS also returns the address of the PPR, if available. 

Note: HLR/HSS may prioritise between the MSC/VLR or SGSN address sent to the GMLC. The prioritisation 
might be based on information received from SGSN and/or MSC/VLR concerning the UE"s capabilities 
for LCS. Other priority criteria are for further study. 

4) If R-GMLC finds out that it is the H-GMLC, the signalUng steps 4 and 12 are skipped. 

If the R-GMLC did not receive the H-GMLC address in step 3 and can not retrieve the H-GMLC address in 
some other way (e.g. DNS lookup), then steps 4, 5, 6, 7, 8, 10, 1 1 and 12 are skipped and the R-GMLC directly 
sends the PSL message to the serving node. 

Otherwise, the R-GMLC sends the location request to the H-GMLC. If one or several of the network addresses 
of the current SGSN and/or VMSC/MSC server, the LCS core network signalling capabilities of the serving 
nodes, IMSI and MSISDN for the target UE and the address of the V-GMLC and the PPR have been retrieved in 
Step 3, the R-GMLC shall pass the information with the location request to the H-GMLC. The R-GMLC shall 
also send the service coverage information to the H-GMLC, if the information is available. 

5) The H-GMLC verifies whether the R-GMLC is authorized to request UE location information. If the R-GMLC is 
not authorized, an error response is returned. 

If the LCS service request contains the pseudonym of the target UE and the H-GMLC cannot resolve the PMD 
address from the pseudonym, the H-GMLC itself determines the verinym (MSISDN or IMSI) of the target UE. If 
the H-GMLC can resolve the address of PMD from the pseudonym, the H-GMLC requests the verinym from its 
associated PMD, see clause 9.1.1.3. In case H-GMLC knows that the PMD functionality is integrated in PPR, it 
can include the information from the LCS Identity Request in the LCS authorisation request to the PPR, see 
clause 9.1.1.1. In this case, if H-GMLC is not able to obtain the verinym of the target UE, the H-GMLC shall 
cancel the location request. 

The H-GMLC performs privacy check on the basis of the UE user"s privacy profile stored in the H-GMLC and 
the capabilities of the serving nodes (MSC/VLR and/or SGSN), if available. If the privacy profile of the target 
UE is stored in a PPR and the H-GMLC received the network address of the PPR from R-GMLC or is able to 
determine the PPR address (e.g. from a previous location request or an internal lookup table), the H-GMLC shall 
ask the PPR to perform the privacy check as described in the 9. 1 . 1 . 1 . If the privacy profile is stored in a PPR but 
the network address of the PPR is not available, the H-GMLC shall send SRI for LCS message to HLR/HSS in 
step 6 in order to get the PPR address and the privacy check in this step shall be performed after step 7. Also if 
the key of the UE user"s privacy profile (i.e. MSISDN or IMSI) is not available, the privacy check in this step 
shall be performed after step 7. The H-GMLC/PPR verifies LCS barring restrictions in the UE user's privacy 
profile in the H-GMLC/PPR. In verifying the barring restrictions, barring of the whole location request is 
assumed if any part of it is barred or any requisite condition is not satisfied. If the location service request is to 
be barred, GMLC shall terminate the request towards the R-GMLC or the LCS client with the appropriate error 
code. As a result of the privacy check, the H-GMLC/PPR selects one or two indicators of the privacy check 
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related action and/or a pseudo-external identity. (The details of the indicator of the privacy check related action 
and the pseudo-external identity are described in chapter 9.5.4 and Annex C). If the requested type of location is 
'current or last known location' and the requested maximum age of location information is available, the H- 
GMLC verifies whether it stores the previously obtained location estimate of the target UE. If the H-GMLC 
stores the location estimate and the location estimate satisfies the requested accuracy and the requested 
maximum age of location, the H-GMLC checks the result of the privacy check. In case the result of the privacy 
check for call/session unrelated class is 'Location allowed without notification' then steps 6, 7, 8, 9 and 10 may 
be skipped. 

6) If the H-GMLC does not know IMSI for the particular MSISDN (e.g. from a previous location request), and the 
VMSC/MSC server address or SGSN address, the H-GMLC shall send a SEND_ROUTING_INFO_FOR_LCS 
message to the home HLR/HSS of the target UE to be located with the IMSI or MSISDN of this UE. Also if the 
privacy profile is stored in a PPR but the network address of the PPR was not available in the step 5, the H- 
GMLC shall send the SRI for LCS message to HLR/HSS. Otherwise, this step and step 7 may be skipped. 

7) The HLR/HSS then returns one or several of the network addresses of the current SGSN and/or VMSC/MSC 
server, the LCS core network signalling capabilities of the serving nodes , the V-GMLC address associated with 
the serving nodes, if available and whichever of the IMSI and MSISDN that was not provided in step (6) for the 
particular UE. The HLR/HSS may also return the address of the PPR, if available. 

Note: HLR/HSS may prioritise between the MSC/VLR or SGSN address sent to the GMLC. The prioritisation 
might be based on information received from SGSN and/or MSC/VLR concerning the UE"s capabilities 
for LCS. Other priority criteria are for further study. 

8) If step 6 and step 7 were performed, the H-GMLC/PPR may do a new privacy check, or if the privacy profile is 
stored in a PPR but the network address of the PPR was not available in step 5 and the PPR address is obtained 
in step 7, the H-GMLC shall ask the PPR to perform the privacy check as described in the 9.1.1.1. 

Also if the location request is an immediate location request and the service coverage information was sent from 
R-GMLC, the H-GMLC checks the country codes of the serving node addresses. If the H-GMLC finds out the 
current SGSN and/or VMSC/MSC server locates out of the service coverage, the H-GMLC returns an 
appropriate error message to the R-GMLC or the LCS client. 

In the cases when the H-GMLC did not receive the address of the V-GMLC, or when the V-GMLC address is 
the same as the H-GMLC address, or when both PLMN operators agree not to use the Lr interface, the H-GMLC 
does not send the location request to the V-GMLC and step 10 is skipped. In this case, the H-GMLC sends the 
location service request message to the serving node. 

If the H-GMLC received the address of the V-GMLC from the HLR/HSS and the V-GMLC address is different 
from the H-GMLC address, the H-GMLC may send the location request to the V-GMLC. The location request 
shall contain one or several of the network addresses of the current SGSN and/or MSC/VLR, and the IMSI and 
MSISDN of the target UE. The location request may also carry the requested action of the VPLMN as the result 
of the privacy check in the H-GMLC (i.e. by using the indicator of the privacy check related action as described 
in chapter 9.5.4 or by using the pseudo-external identity as described in Annex C). The V-GMLC first 
authenticates that the location request is allowed from this GMLC, PLMN or from this country. If not, an error 
response is returned. 

9) In case the GMLC (H-GMLC, R-GMLC or V-GMLC) receives only the MSC/VLR address, the MT LR 
proceeds as the CS-MT-LR procedure described in 9.1.2. In case GMLC receives only the SGSN address, the 
MT LR proceeds as the PS-MT-LR procedure described in 9.1.6. In case the GMLC receives several of the 
following addresses, SGSN, VMSC and/or MSC Server, it has to decide where to send the location request. If 
the requested MT-LR is known to be associated with a CS call, the CS-MT-LR procedure shall be invoked. If the 
requested MT-LR is associated with a PS session, the PS-MT-LR procedure shall be invoked. Otherwise, both 
CS-MT-LR and PS-MT-LR are appUcable. If LCS Client indicated deferred location request, GMLC shall 
indicate this together with applicable event type (e.g. UE available) in the requested PS/CS-MT-LR, see 9.1.8. 

NOTE: The order in which these procedures are invoked and whether one or both procedures are used may 

depend on information in the LCS service request, subscription information for the LCS client, possible 
priority information returned by the HSS or information already stored in the GMLC (e.g. obtained from 
previous location requests). 

10) The V-GMLC sends the location service response to the H-GMLC in accordance with the requested LCS QoS 
Class. If the requested LCS QoS class was Assured, V-GMLC sends the result only if the result has been 
indicated to fulfil the requested accuracy, otherwise V-GMLC sends a LCS service response with a suitable error 
cause. If the UE requested LCS QoS class was Best Effort, V-GMLC sends whatever result it received with an 
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appropriate indication if the requested accuracy was not met. The location service response may contain the 
information about the positioning method used. The V-GMLC may record charging information. 

1 l)If the privacy check in step 5 indicates that further privacy checks are needed, or on the basis of the privacy 
profile, the H-GMLC shall perform an additional privacy check or the H-GMLC may ask the PPR to perform the 
privacy check as described in the 9.1.1.1 in order to decide whether the H-GMLC can forward the location 
information to the LCS client. If the location request from the R-GMLC or the LCS client contained the 
pseudonym, the H-GMLC shall use the pseudonym of the target UE in the location response to the R-GMLC or 
the LCS client. One example when this additional privacy check is needed is when the target UE user has 
defined different privacy settings for different geographical locations. 

12) The H-GMLC sends the location service response to the R-GMLC. The H-GMLC may store the location 

information and its age. The location service response may contain the information about the positioning method 
used and the indication whether the obtained location estimate satisfies the requested accuracy or not. The H- 
GMLC may record charging information. 

13) R-GMLC sends the location service response to the LCS client. If the location request from the LCS client 
contained the pseudonym and the R-GMLC resolved the verinym from the pseudonym in the step 1, the R- 
GMLC shall use the pseudonym of the target UE in the location response to the LCS client. If the LCS client 
requires it, the R-GMLC may first transform the universal location co-ordinates provided by the SGSN or 
MSC/MSC server into some local geographic system. The R-GMLC may record charging information both for 
the LCS client and inter-network revenue charges from the SGSN or MSC/MSC server's network. The location 
service response from the R-GMLC to the LCS client may contain the information about the positioning method 
used and the indication whether the obtained location estimate satisfies the requested accuracy or not. 

The detailed CS-MT-LR and PS-MT-LR procedures in step 9 of figure 9.1 are described in 9.1.2 and 9.1.6.The detailed 
procedure for deferred PS/CS-MT-LR is described in 9.1.8. 



9.1 .1 A Common MT-LR procedure in PS and CS domain for Emergency 
MT-LR 

This clause describes how an emergency location request may be handled similarly to a normal location request. This 
method should be restricted to those countries where there is not a national requirement to provide location for callers 
who are either roaming or making an emergency call from a SIM-less UE. It is also appropriate to use this method to 
provide location for lawful intercept services where allowed by national regulation. 
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Figure 9.1 A: Network Positioning for an Emergency IVIT-LR 

1) An external LCS client which has the privacy override capability, (e.g. Emergency service provider), requests the 
location of a target UE from a GMLC. The R-GMLC verifies the identity of the LCS client and its subscription 
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to the LCS service requested and derives the MSISDN or IMSI of the target UE to be located and the LCS QoS 
from either subscription data or data suppUed by the LCS chent. 

2) If the R-GMLC already knows IMSI for the particular MSISDN, (e.g. from a previous location request) and the 
VMSC/MSC server address or SGSN address, this step and step 3 may be skipped. Otherwise, the R-GMLC 
sends a SEND_ROUTING_INFO_FOR_LCS message to the home HLR/HSS of the target UE to be located 
with the IMSI or MSISDN of this UE. 

3) The HLR/HSS verifies whether the R-GMLC is authorized to request UE location information. If not, an error 
response is returned. 

Otherwise the HLR/HSS returns one or several of the network addresses of the current SGSN and/or 
VMSC/MSC server and whichever of the IMSI and MSISDN that was not provided in step 2. The HLR/HSS 
also returns the address of the V-GMLC associated with the serving nodes, if available. 

Note: HLR/HSS may prioritise between the MSC/VLR or SGSN address sent to the GMLC. The prioritisation 
might be based on information received from SGSN and/or MSC/VLR concerning the UE"s capabilities 
for LCS. Other priority criteria are for further study. 

4) In the cases when the R-GMLC did not receive the address of the V-GMLC, or when the V-GMLC address is 
the same as the R-GMLC address, or when both PLMN operators agree not to use the Lr interface, the R-GMLC 
does not send the location request to the V-GMLC and the step 6 is skipped. In this case, the R-GMLC sends the 
location service request message directly to the serving node. 

If the R-GMLC received the address of the V-GMLC from the HLR/HSS and the V-GMLC address is different 
from the R-GMLC address, the R-GMLC sends the location request to the V-GMLC. The location request shall 
contain one or several of the network addresses of the current SGSN and/or MSC/VLR, the IMSI and MSISDN 
of the target UE and the privacy override indicator. The V-GMLC first authenticates that the location request is 
allowed from this GMLC, PLMN or from this country. If not, the positioning request is rejected and an error 
response is returned. Otherwise, it sets the privacy indicator to 'not allowed' and includes it with the POI in the 
Provide Subscriber Location message. 

5) In case the GMLC receives only the MSC/VLR address, the MT LR proceeds as the CS-MT-LR procedure 
described in 9.1.2. In case GMLC receives only the SGSN address, the MT LR proceeds as the PS-MT-LR 
procedure described in 9.1.6. In case the GMLC receives several of the following addresses, SGSN, VMSC 
and/or MSC Server, it has to decide where to send the location request. In any case the serving node checks for 
POI applicability. 

NOTE: The order in which these procedures are invoked and whether one or both procedures are used may 

depend on information in the LCS service request, subscription information for the LCS client, possible 
priority information returned by the HLR/HSS or information already stored in the GMLC (e.g. obtained 
from previous location requests). 

6) The V-GMLC sends the location service response to the R-GMLC. The location service response may contain 
the information about the positioning method used. The V-GMLC may record charging information. 

7) R-GMLC sends the location service response to the LCS client. If the LCS client requires it, the R-GMLC may 
first transform the universal location co-ordinates provided by the SGSN or MSC/MSC server into some local 
geographic system. The location service response from the GMLC to the LCS client may contain the information 
about the positioning method used. After receiving (stage 3) acknowledgement from the LCS client, the R- 
GMLC may record charging information both for the LCS client and inter-network revenue charges from the 
SGSN or MSC/MSC server's network. 

The detailed CS-MT-LR and PS-MT-LR procedures in step 5 of figure 9.1 A are described in 9.L2 and 9.L6. 

9.1 .1 .1 LCS Authorisation request 

If the UE subscribers LCS privacy information is kept in the PPR the GMLC (H-GMLC) shall send a LCS 
Authorisation request to PPR, see figure 9. IB. 
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Figure 9.1 B: LCS authorisation in PPR 

1) The GMLC sends the LCS authorisation request to the PPR. The LCS authorisation request carries the type of 
location information requested (e.g. current location), the LCS client type, the UE subscriber's identity and 
indication whether the request is call/session related or call/session unrelated. The UE subscriber's identity can 
be one or both of MSISDN and IMSI. If PMD functionality is integrated in PPR, the LCS authorization request 
may carry the pseudonum of the target UE, instead of the verinym. In case GMLC received the LCS client" s 
called party number or the APN-Nl of the target mobile"s session, GMLC shall request both call/session related 
and call/session unrelated privacy checks in PPR. In case GMLC did not receive the LCS client's called party 
number or the APN-NI of the target mobile"s session, GMLC requests only a call/session unrelated privacy 
check in PPR. For a value added LCS client, the message shall carry the client"s name, the external identity of 
the LCS client and the requestor identity (if that is both supported and available). Moreover the message may 
also carry the Service Type and the Codeword. This message shall also carry the LCS capabilities of the SGSN 
or VMSC/MSC server. 

In case the additional privacy check was requested to be performed after the positioning procedure the LCS 
Authorisation Request shall also include the location estimate. 

2) If the LCS authorization request contains the pseudonym of the target UE, the PPR with PMD functionality 
seeks to determine the verinym of the target UE. PPR performs the privacy check based on the target UE"s 
privacy profile. The result of that privacy check is sent to GMLC in the LCS Authorisation response. If the 
location request is to be barred, the PPR shall send an indication of this within the LCS Authorisation response 
and no other indicators. If requested by the GMLC the PPR shall include two privacy check results for the LCS 
Authorisation response, both call/session related and call/session unrelated privacy check results. The response 
may also contain information if an additional privacy check is needed when the GMLC has received the location 
information of the target UE (e.g. if the target UE allows its location information to be given to the LCS client 
only when it is located in certain areas). 

If the LCS authorisation request contains the pseudonym of the target UE and the PPR has integrated PMD 
functionality, the PPR shall return the target UE"s IMSI and/or MSISDN corresponding to the pseudonym in 
the LCS authorisation response. 

If PPR received information that the visited MSC/SGSN is pre Rel-6 it shall select a pseudo external ID which 
shall carry the response of the privacy check. For more information on pseudo external Ids, see Annex C. 



9.1.1.2 



LCS Privacy Profile Update 



If the UE subscribers privacy information has been changed in the PPR the LCS Privacy Profile Update shall be 
send to the GMLC (H-GMLC), see figure 9.1C. 
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Figure 9.1 C: PPR notification to GIVILC about LCS privacy profile change 

1) In case subscriber changed his privacy profile information in the PPR the LCS Privacy Profile Update shall be 
send to the GMLC (H-GMLC). The message shall carry the idenity of the UE subscriber. 

2) GMLC acknowledges that it received the notification 

9.1 .1 .3 LCS identity request 

The GMLC may request the verinym of the UE from the PMD, see figure 9. ID. 



Figure 9.1 D: LCS identity request 
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1) The GMLC sends the pseudonym to its associated PMD and requests the corresponding verinym of the target 
UE from PMD. 

2) The PMD shall map or decrypt (e.g. using the private key of the operator) the target UE"s pseudonym to the 
corresponding verinym, i.e. IMSI and /or MSISDN, to be included in the Identity Response. 

9.1 .2 Circuit Switched Mobile Terminating Location Request (CS-MT-LR) 

Figure 9.2 illustrates general network positioning for LCS clients external to the PLMN. In this scenario, it is assumed 
that the target UE is identified using either an MSISDN or IMSI. 
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Figure 9.2: Network Positioning for a CS-IUIT-LR 
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9.1.2.1 Location Preparation Procedure 

1) Common PS and CS MT-LR procedure as described in 9.1.1. 

2) The GMLC sends a PROVIDE. SUBSCRIBER .LOCATION message to the MSC/MSC server indicated by 
the HLR/HSS. This message carries the type of location information requested (e.g. current location), the UE 
subscriber's IMSI, LCS QoS information (e.g. accuracy, response time) and an indication of whether the LCS 
client has the override capability. For a call related location request, the message also carries the LCS client's 
called party number. For a value added LCS client, the message shall carry the client name, the external identity 
of the LCS client (or the pseudo external identity) and the Requestor Identity (if that is both supported and 
available). Also the message may carry the type of the LCS client name and also the type of the Requestor 
identity if the requestor identity was included. For a PLMN operator LCS client, the message shall carry the 
internal identity of the LCS client. Moreover the message may also carry the Service Type. If the result of the 
privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the message may carry 
also the codeword received from the LCS client. For a PLMN operator LCS client, the message shall carry the 
internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall send it as separate 
information. In addition, in order to display the requestor identity in case of pre rel-5 network elements (i.e. 
MSC and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. When the 
Requestor identity is added to the LCS client name the practise described in the Annex D should be followed. 
The message also shall carry the indicators of privacy related action which is described in chapter 9.5.4 , if it is 
provided by H-GMLC. 

3) If the GMLC is located in another PLMN or another country, the VMSC/MSC server first authenticates that a 
location request is allowed from this PLMN or from this country. If not, an error response is returned. If the PSL 
message from the GMLC contains the indicators of privacy related action, the 'VMSC/MSC server determines a 
required privacy related action as described in Annex A.3. If the PSL message from the GMLC does not include 
the indicators of privacy related action, the 'VMSC/MSC server then verifies LCS barring restrictions in the UE 
user's subscription profile in the MSC server. In verifying the barring restrictions, barring of the whole location 
request is assumed if any part of it is barred or any requisite condition is not satisfied. If LCS is to be barred 
without notifying the target UE and a LCS client accessing a GMLC in the same country does not have the 
override capability, an error response is returned to the GMLC. 

Otherwise, if the UE is in idle mode, the Core Network performs paging, authentication and ciphering. The MSC 
will page a GPRS attached UE either through A/Iu or Gs interface, depending on the presence of the Gs interface 
(see Note 2). The UE will inform the network about its LCS capabilities, as described in chapter 6.3.4. If the UE 
is instead in dedicated mode, the VMSC/MSC server will already have UE classmark information. In GSM this 
is supported by controlled early classmark sending. 

Note 1 : In GSM, if the target UE has an established circuit call other than speech, the location request may be 
denied and an error response is then returned to the GMLC. If the location request is allowed for a non- 
speech circuit call, it shall be up to RAN to decide, on the basis of the applicable position methods and 
requested QoS, whether positioning is possible. 

Note 2: In some network mode of operation, a GPRS capable UE may not receive the CS paging. In addition, 
upon receipt of a CS paging, a GPRS capable UE may immediately answer to the Paging Request or 
delay the answer, as defined in 3GPP TS 22.060 [35b] and 23.060 [15]. A GPRS UE in class B mode may 
also suspend its GPRS traffic, sending a GPRS Suspension Request to the network. 

4) If the location request comes from a value added LCS client and the indication of requested privacy related 
action or the UE subscription profile indicates that the UE must either be notified or notified with privacy 
verification and the UE supports notification of LCS (according to the UE Capability information), an LCS 
Location Notification Invoke message is sent to the target UE indicating the type of location request (e.g. current 
location) and the identity of the LCS client, the Requestor Identity (if that is both supported and available) and 
whether privacy verification is required. Also the message may indicate the type of the LCS client name and also 
the type of the Requestor identity if the requestor identity was included. Moreover, the message may carry also 
the service type and the codeword. 

Optionally, the VMSC/MSC server may, after sending the LCS Location Notification Invoke message continue 
in parallel the location process, i.e. continue to step 6 without waiting for a LCS Location Notification Return 
Result message in step 5. 

NOTE 3: It is for further study, if all available client identities are to be included in the Privacy Notification 
message to be shown to the end-user. 
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5) The target UE notifies the UE user of the location request. If privacy verification was requested, the target UE 
indicates to the UE user whether the location request will be allowed or not allowed in the absence of a response 
and waits for the user to grant or withhold permission. The UE then returns an LCS Location Notification Return 
Result to the VMSC/MSC server indicating, if privacy verification was requested, whether permission is granted 
or denied. Optionally, the LCS Location Notification Return Result message can be returned some time after 
step 4, but before step 9. If the UE user does not respond after a predetermined time period, the VMSC/MSC 
server shall infer a "no response" condition. The VMSC/MSC server shall return an error response to the GMLC 
if privacy verification was requested and either the UE user denies permission or there is no response with the 
UE subscription profile indicating barring of the location request in the absence of a response. 

6) The MSC/MSC server sends a Location Request message to RAN. This message includes the type of location 
information requested and requested QoS and, in GSM, the UE's location capabilities. 

9.1 .2.2 Positioning IVIeasurement Establishment Procedure 

7) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .2.3 Location Calculation and Release Procedure 

8) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the MSC/MSC 
server in a Location Report message. RAN shall in its response include an indication whether the obtained 
location estimate satisfies the requested accuracy or not. The information about the positioning method used may 
be returned with the location estimate. If a location estimate could not be obtained, RAN returns a Location 
Report message containing a failure cause and no location estimate. 

9) The MSC/MSC server returns the location information, its age and obtained accuracy indication to the GMLC, if 
the VMSC/MSC server has not initiated the Privacy Verification process in step 4. If step 4 has been performed 
for privacy verification, the VMSC/MSC server returns the location information only, if it has received a LCS 
Location Notification Return Result indicating that permission is granted. In these cases, the information about 
the positioning method used may be sent with the location information. If a LCS Location Notification Return 
Result message indicating that permission is not granted is received, or there is no response, with the requested 
privacy action or the UE subscription profile indicating barring of location in the absence of a response, the 
VMSC/MSC server shall return an error response to the GMLC. If RAN did not return a successful location 
estimate, but the privacy checks in steps 4-5 were successfully executed, the VMSC/MSC server may return the 
last known location of the target UE if this is known and the LCS client is requesting the current or last known 
location. The MSC/MSC server may then release the Mobility Management connection to the UE, if the UE was 
previously idle, and the MSC/MSC server may record charging information. 

10)Common MT-LR procedure in PS and CS domain as described in 9.LL 

9.1.3 CS-MT-LR without HLR Query 

Figure 9.3 illustrates current or last known location requests for an emergency services call, where an emergency 
services client (i.e., a Public Safety Answering Point) identifies the target UE and the serving GMLC using correlation 
information that were previously provided to it by the VMSC. In North America, this correlation information is 
provided by either an NA-ESRK, or an MSISDN and NA-ESRD. The signaling used to provide the correlation 
information to the PSAP is out of scope of this TS, but is presumed to occur on the signaling for the call. This allows 
the requesting V-GMLC to request location from the VMSC without first querying the home HLR of the target UE. 
This scenario therefore supports location of emergency callers from roamers or SIM -less mobiles, and requires that the 
initial location, as well as UE and VMSC identifying information had been pushed to the GMLC as per 9.L5 (or 
9.L5.A for North America). In North America, additional requirements are found in [32]. 
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Figure 9.3: Positioning for a Emergency Services lUIT-LR without IHLR Query 

1) Same as step 1 in figure 9.1 but with the LCS client (PSAP) identifying first the target UE and the serving V- 
GMLC by previously supplied correlation information for the emergency call. 

2) The GMLC may determine the VMSC from correlation information received from the PSAP, or from stored 
information for the target UE (e.g. from a prior location estimate delivery from the VMSC/MSC server). In 
North America, the GMLC determines the VMSC using the NA-ESRK or NA-ESRD - with use of the NA- 
ESRK taking priority over that of the NA-ESRD. The MAP_PROVIDE_SUBSCRIBER_LOCATION message 
sent to the VMSC carries the MSISDN and, if provided, the IMSI and IMEI for the target UE, as well as the 
required QoS and an indication of a location request from an emergency services client. The VMSC identifies 
the target UE using the IMSI or MSISDN and, if provided, the IMEI. In case a SIM-less UE is used to make the 
emergency call, the IMEI shall be always sent and the MSISDN may be populated with a non-dialable callback 
number as specified in clause 6.4.3. 

3) The MSC verifies that UE privacy is overridden by the emergency services provider and that positioning is not 
prevented for other reasons (e.g. unreachable UE, inapplicable call type to the UE). The VMSC then sends a 
Location Request to the RAN, as for a normal MT-LR. 

4) RAN performs positioning as for a normal CS-MT-LR. 

5) RAN returns a location estimate to the VMSC as for a normal CS-MT-LR. 

6) Same as step 9 for a normal CS-MT-LR. 

7) Same as step 10 for a normal CS-MT-LR. 

9.1 .4 CS-MT-LR and PS-MT-LR for a previously obtained location 
estimate 

Every time the location estimate of a target UE subscriber is returned by the RAN to the VMSC, MSC Server or SGSN, 
the corresponding entity may store the location estimate together with a time stamp. The MSC/MSC server may store 
this information in the subscriber's MSC server record. Also when the location estimate of a target UE subscriber is 
returned to the H-GMLC, the H-GMLC may store the location estimate together with the age in the subscriber's record. 

The time stamp is the time at which the location estimate is stored at the corresponding entity i.e. after the RAN returns 
the location estimate to the VMSC, MSC Server or SGSN. The time stamp indicates the "age" of the location estimate. 
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9.1.4.1 Initial Location 

In the context of an originating emergency call the location estimate and the associated time stamp at the 
commencement of the call set-up is referred to as "initial location". 

9.1.4.2 Current Location 

After a location attempt has successfully delivered a location estimate and its associated time stamp, the location 
estimate and time stamp is referred to as the "current location" at that point in time. 

9.1 .4.3 Last known Location 

Depending on national regulations, the current location estimate and its associated time stamp may be stored in 
MSCA'^LR, MSC Server, SGSN, or in H-GMLC and until replaced by a later location estimate and a new time stamp is 
referred to as the "last known location". The last known location may be distinct from the initial location - i.e. more 
recent. 

9.1.4.4 Security and Privacy 

The collection and/or the release of the last known and initial location estimate of the target UE may not be allowed by 
national option. The handling of security and privacy of the target UE with regard to returning the last known or initial 
location estimate of the target UE shall be the same as when the target UE is reachable for positioning, (i.e. the 
requesting LCS client is authorized and the privacy of the target UE is secured before the VMSC/MSC server check the 
MSC server status of the target UE (i.e. whether the UE is marked as attached or detached in the MSC server). A similar 
status check apply for SGSN and MSC Server. 

9.1 .4.5 Failing to locate the target UE 

In case of a "Detached" or "Not Reachable" target UE, the last known location and a time stamp stored at the VLR, 
MSC Server or SGSN, may be returned to a LCS client requesting location information if the LCS client specifically 
requested the current or last known location. This does not apply to a value added LCS client where the target UE 
subscribes to notification of the location request: if the notification cannot be performed, the VMSC, MSC Server or 
SGSN shall reject the location request. 

NOTE: Due to CAMEL, the MSC/MSC server/VLR may already be storing other location information 

parameters like location number, service area identity and MSC server number in the subscriber's MSC 
server record. 

When a request for location information is received at the VMSC, MSC Server or SGSN, the request shall indicate 
whether the "last known location of the target UE" should be returned in case of a "detached" or "not reachable" target 
UE. 

If the VLR, MSC Server or SGSN has a valid copy of the subscriber's permanent data and the target UE's privacy 
settings are such that positioning is allowed, then the following two cases can occur. 

9.1 .4.5.1 Target UE is "Not Reachable" 

If the target UE is marked as "attached" in the VLR, MSC Server or SGSN, the corresponding entity orders paging of 
the target UE. If paging fails, due to target UE being "not reachable" then the corresponding VMSC, MSC Server or 
SGSN shall check whether the LCS client has requested "last known location" in case of "not reachable" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the VMSC, MSC 
Server or SGSN shall include the last known location together with the time stamp available in its response to the 
request for location information. 

An indicator of "last known location" returned shall be marked at the CDR at VMSC, MSC Server or SGSN 
correspondingly. 
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9.1 .4.5.2 Target UE is "Detached" 

If the target UE is marked as "detached" in the VLR, MSC Server or SGSN, the corresponding entity shall check 
whether the LCS client has requested "last known location" in case of "detached" target UE. 

If such a request exists and notification to the target UE does not apply for a value added LCS client, the VMSC, MSC 
Server or SGSN includes the "last known location" together with the time stamp available in its response to the request 
for location information. 

An indicator of "last known location" returned shall be marked at the CDR at VMSC, MSC Server or SGSN. 

9.1 .4.5.3 Target UE is Reachable but Positioning Fails 

If the target UE is reachable (e.g. paging succeeds), but the VMSC, MSC Server or SGSN is unable to obtain a current 
location estimate, then the corresponding entity shall check whether the LCS client has requested "last known location". 

If such a request exists and notification to the target UE either does not apply or was successfully executed for a value 
added LCS client, the VMSC, MSC Server or SGSN includes the "last known location" together with the time stamp 
available in its response to the request for location information. An indicator of "last known location" returned shall be 
marked at the CDR at VMSC. 

9.1 .4.5.4 MSC Server or SGSN.Target UE is "Purged" 

If the target UE is marked as "Purged" in HLR/HSS, then an indication "Absent Subscriber" is returned to the GMLC. 
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9.1 .5 Network Induced Location Request (NI-LR) 

Figure 9.4 illustrates how the initial position for an emergency service call is determined when the subscriber initiates 
the emergency call. 
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Figure 9.4: Positioning for a NI-LR Emergency Service Call 



Location Preparation Procedure 



1) An initially idle UE requests radio connection setup indicating a request for an Emergency Service call to the 
VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. (Before having a CM connection there must be a 
radio connection.) The UE may identify itself using a TMSI, IMSI or IMEI. 

3) The emergency call procedure is applied. The VMSC/MSC server determines based on the serving cell the 
appropriate emergency services client. The VMSC/MSC server, RAN and UE continue the normal procedure for 
emergency call origination towards that emergency services client. Depending on local regulatory requirements, 
the sending of call setup information into the PSTN may be delayed until either the UE's location has been 
obtained or the location attempt has failed or a PLMN defined timer has expired before location was obtained. If 
the serving cell serves an area that contains the service domain of multiple emergency services clients, the 
VMSC/MSC server may delay call setup and invoke location based routing procedures described in section 

9. 1.5 A. Call setup information sent into the PSTN may include the UE location (if already obtained) plus 
information that will enable the emergency service provider to request UE location at a later time (e.g. NA- 
ESRD or NA-ESRK in North America). 
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4) At any time after step 2, the VMSC/MSC server may initiate procedures to obtain the UE's location. These 
procedures may run in parallel with the emergency call origination. The VMSC/MSC server sends a Location 
Request message to RAN associated with the UE's current location area (see step 6 for a MT-LR). This message 
includes the QoS required for an emergency call. 

9.1.5.2 Positioning Measurement Establishment Procedure 

5) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .5.3 Location Calculation and Release Procedure 

6) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the 
VMSC/MSC server in a Location Report. As a national option. Cell ID positioning accuracy is allowed. RAN 
shall in its response include an indication whether the obtained location estimate satisfies the requested accuracy 
or not. The information of the positioning method used may be returned with the location estimate. If a location 
estimate could not be obtained, the RAN returns a location response containing a failure cause and no location 
estimate. 

7) Depending on local regulatory requirements, the VMSC/MSC server may send a MAP Subscriber Location 
report to a GMLC associated with the emergency services provider to which the emergency call has been or will 
be sent. This message shall carry any location estimate returned in step 6 including the indication received from 
RAN whether the obtained location estimate satisfies the requested accuracy or not, the age of this estimate and 
may carry the MSISDN, IMSI and IMEI of the calling UE, the information about the positioning method used 
and the serving cell identity or S AI of the UE. In case a SIM-less UE is used to make the emergency call, the 
IMEI shall be always sent and the MSISDN may be populated with a non-dialable callback number as specified 
in clause 6.4.3. In North America, any NA-ESRD and any NA-ESRK that may have been assigned by the 
VMSC/MSC server shall be included. The message shall also indicate the event that triggered the location 
report. If location failed (i.e. an error result was returned by RAN in step 6), an indication of failure rather than a 
location estimate may be sent to the GMLC: the indication of failure is conveyed by not including a location 
estimate in the MAP Subscriber Location Report. The MSC/MSC server may record charging information. 

8) The GMLC acknowledges receipt of the location information. The GMLC shall store the location information 
for later retrieval by the emergency services LCS client. 

9) The GMLC may optionally forward the information received in step 8 to the emergency services LCS client. The 
GMLC may also record charging information. The client is expected to obtain the location information by 
requesting it from the GMLC. The information about the positioning method used may be sent with the location 
information from the GMLC to the LCS client. 

10) At some later time, the emergency services call is released. 

1 l)The MSC/MSC server sends another MAP Subscriber Location Report to the GMLC. This message may include 
the same parameters as before except that there is no position estimate and an indication of emergency call 
termination is included. 

12) The GMLC acknowledges the MSC/MSC server notification and may then delete all information previously 
stored for the emergency call per national regulation. 
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9.1 .5A NI-LR using Location Based Routing - applicable to North American 
Emergency Calls only 

Figure 9.4A illustrates positioning for an emergency service call using location based routing. 
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Figure 9.4A: Positioning for a NI-LR Emergency Service Call using Location Based Routing 
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9.1.5A.1 Location Preparation Procedure 

1) An initially idle UE requests radio connection setup indicating a request for an Emergency Service call to the 
VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. (Before having a CM connection there must be a 
radio connection.) The UE may identify itself using a TMSI, IMSI or IMEI. 

3) The VMSC/MSC server determines that the serving cell serves an area that contains portions of multiple 
emergency services zones. Therefore, the VMSC/MSC server delays call setup and initiates procedures to obtain 
the UE's location for routing the emergency call to the emergency services LCS client. The VMSC/MSC server 
sends a Location Request message to RAN associated with the UE's current location area. This message includes 
the type of location information requested, the UE"s location capabilities and a QoS with low delay and low 
horizontal accuracy. 

9.1 .5A.2 Positioning Measurement Establishment Procedure 

4) RAN determines the positioning method and instigates the particular message sequence for this method, as 
specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 43.059 [16]. 

9.1 .5A.3 Location Calculation and Release Procedure 

5) When a location estimate best satisfying the requested QoS has been obtained, RAN returns it to the 
VMSC/MSC server. If a location estimate could not be obtained, the RAN returns a location response containing 
a failure cause and no location estimate. If a failure is received, the VMSC/MSC server initiates emergency call 
setup using the normal NI-LR procedures. 

6) The VMSC/MSC server sends a MAP Subscriber Location Report to a GMLC associated with the emergency 
services provider to which the emergency call will be sent. This message shall carry any location estimate 
returned in step 5, the age of this estimate and may carry the MSISDN, IMSI, IMEI of the calling UE, the 
information about the positioning method used and the serving cell identity or S AI of the UE. In case a SIM-less 
UE is used to make the emergency call, the IMEI shall be always sent and the MSISDN shall be populated with 
a non-dialable callback number as specified in clause 6.4.3. The message shall also indicate the event that 
triggered the location report. Any NA-ESRD and NA-ESRK that was assigned by the VMSC/MSC server shall 
be included. The message shall also include an indication that the VMSC/MSC server supports the capability to 
replace an NA-ESRK or NA-ESRD value with the one assigned by the GMLC. The VMSC/MSC server and 
GMLC may record charging information. 

7) The GMLC translates the location estimate into a zone identity and assigns either a NA-ESRK or a NA-ESRD, 
which was requested by the VMSC/MSC server. The GMLC shall include either the NA-ESRK value or the NA- 
ESRD value in the MAP Subscriber Location Report ack and send it to the VMSC/MSC server. The GMLC 
stores either the assigned NA-ESRD or the assigned NA- ESRK and any NA-ESRD that was sent by the 
VMSC/MSC server in step 6. 

9.1.5A.4 Location Preparation Procedure 

8) The emergency call procedure is applied. The VMSC/MSC server, RAN and UE continue the normal procedure 
for emergency call origination towards the appropriate emergency services client. Call setup information sent 
into the PSTN may include the UE location plus information that will enable the emergency service provider to 
request UE location at a later time (NA-ESRD or NA-ESRK in North America). The NA-ESRK or NA-ESRD 
used shall be the one received from the GMLC. If a NA-ESRK or NA-ESRD is not received from the GMLC 
then the VMSC/MSC server shall employ default routing for the call using a default NA-ESRK, default NA- 
ESRD or other default number as in 9. L5. 1 step 3. 

9) At any time after step 8, the emergency services LCS client may request location information. 

10) At any time after step 6, the GMLC may send a MAP Provide Subscriber Location message to the VMSC/MSC 
server. This message includes a QoS with higher delay and higher horizontal accuracy required for an emergency 
call. In case a SIM-less UE is used to make the emergency call, the IMEI shall be included in the message. 

If the GMLC is capable of determining whether the initial location satisfies the higher accuracy requirements for 
an emergency call, then the GMLC may not need to request for a higher accuracy location. 
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ll)The VMSC/MSC server sends a Location Request message to RAN. This message includes the type of location 
information requested, the UE"s location capabilities and requested higher accuracy QoS. 

9.1 .5A.5 Positioning Measurement Establishment Procedure 

12) same as step 4. 

9.1 .5A.6 Location Calculation and Release Procedure 

13) same as step 5. 

14) The VMSC/MSC server returns the location information and its age, the information about the positioning 
method used and the serving cell identity or S AI of the UE to the GMLC. The GMLC shall replace the 
previously stored low accuracy location information with the higher accuracy information for later retrieval by 
the emergency services LCS client. The VMSC/MSC server and GMLC may record charging information. 

15) The GMLC may forward the information received in the previous step to the emergency services LCS client. 
The client is expected to have requested this information from GMLC before. The information about the 
positioning method used may be sent with this location information from the GMLC to the LCS client. 

16) same as step 10 for normal NI-LR. 

17) same as step 1 1 for normal NI-LR. 

18) same as step 12 for normal NI-LR. 

9.1 .6 Packet Switched Mobile Terminating Location Request 
(PS-MT-LR) 

Figure 9.5 illustrates the general network positioning for LCS clients external to the PLMN for packet switched 
services. In this scenario, it is assumed that the target UE is identified using an MSISDN or IMSI. 
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Figure 9.5: General Network Positioning for Packet Switched MT-LR 



Location Preparation Procedure 



1) Common PS and CS MT-LR procedure as described in 9.1.1. 

2) GMLC sends a Provide Subscriber Location message to the SGSN indicated by the HLR/HSS. This message 
carries the type of location information requested (e.g. current location), the UE subscriber's IMSI, LCS QoS 
information (e.g. accuracy, response time) and an indication of whether the LCS client has the override 
capability. Eor a session related location request, the message also carries the APN-NI to which the user has 
established the session. Eor a value added LCS client, the message shall carry the client name, the external 
identity of the LCS client (or the pseudo external identity) and the Requestor Identity (if that is both supported 
and available), optionally the message may also carry the Service Type. Also the message may carry the type of 
the LCS client name and also the type of the Requestor identity if the requestor identity was included. If the 
result of the privacy check at H-GMLC/PPR indicated that the codeword shall be sent to the UE user, the 
message may carry also the codeword received from the LCS client. Eor a PLMN operator LCS client, the 
message shall carry the internal identity of the LCS client. If the Requestor Identity is provided, the GMLC shall 
send it as separate information. In addition, in order to display the requestor identity in case of pre rel-5 network 
elements (i.e. SGSN and/or UE), the requestor identity may be also added to the LCS client name by the GMLC. 
When the Requestor identity is added to the LCS client name the practise described in the Annex D should be 
followed. The message also shall carry the indicators of privacy related action which is described in chapter 
9.5.4 , if it is provided by H-GMLC. 
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3) If the GMLC is located in another PLMN or another country, the SGSN first authenticates that a location request 
is allowed from this PLMN or from this country. If not, an error response is returned. If the PSL message from 
the GMLC includes the indicators of privacy related action, the SGSN determines a required privacy related 
action as described in Annex A.3. If the PSL message from the GMLC does not include the indicators of privacy 
related action, the SGSN then verifies LCS barring restrictions in the UE user's subscription profile in the SGSN. 
In verifying the barring restrictions, barring of the whole location request is assumed if any part of it is barred or 
any requisite condition is not satisfied. If LCS is to be barred without notifying the target UE and a LCS client 
accessing a GMLC in the same country does not have the override capability, an error response is returned to the 
GMLC. 

Otherwise, if the UE is in idle mode, the SGSN performs paging. The paging procedure is defined in TS 
23.060[15]. 

4) Security functions may be executed. These procedures are defined in TS 23.060 [15]. 

5) If the location request comes from a value added LCS client and the indicators of privacy related action or the 
UE subscription profile indicates that the UE must either be notified or notified with privacy verification and the 
UE supports notification of LCS, a notification invoke message is sent to the target UE indicating the type of 
location request (e.g. current location) and the identity of the LCS client and the Requestor Identity (if that is 
both supported and available), whether privacy verification is required. Also the message may indicate the type 
of the LCS client name and also the type of the Requestor identity if the requestor identity was included. 
Moreover, the message may carry also the service type and the codeword. Optionally, the SGSN may after 
sending the LCS Location Notification Invoke message continue in parallel the location process, i.e. continue to 
step 7 without waiting for a LCS Location Notification Return Result message in step 6. 

6) The target UE notifies the UE user of the location request and, if privacy verification was requested, waits for the 
user to grant or withhold permission. The UE then returns a notification result to the SGSN indicating, if privacy 
verification was requested, whether permission is granted or denied. Optionally, this message can be returned 
some time after step 5, but before step 10. If the UE user does not respond after a predetermined time period, the 
SGSN shall infer a "no response" condition. The SGSN shall return an error response to the GMLC if privacy 
verification was requested and either the UE user denies permission or there is no response with the UE 
subscription profile indicating barring of the location request. 

7) The SGSN sends a Location Request message to the RAN. This message includes the type of location 
information requested, the requested QoS and any other location information received in paging response. 

9.1 .6.2 Positioning Measurement Establishment Procedure 

8) If the requested location information and the location accuracy within the QoS can be satisfied based on 
parameters received from the SGSN and the parameters obtained by the RAN e.g. cell coverage and timing 
information (i.e. RTT or TA), the RAN may send a Location Report immediately. Otherwise, the RAN 
determines the positioning method and instigates the particular message sequence for this method in UTRAN 
Stage 2 TS 25.305 [1] and in GERAN Stage 2 TS 43.059 [16]. If the position method returns position 
measurements, the RAN uses them to compute a location estimate. If there has been a failure to obtain position 
measurements, the RAN may use the current cell information and, if available, RTT or TA value to derive an 
approximate location estimate. If an already computed location estimate is returned for an UE based position 
method, the RAN may verify consistency with the current cell and, if available, RTT or TA. If the location 
estimate so obtained does not satisfy the requested accuracy and sufficient response time still remains, the RAN 
may instigate a further location attempt using the same or a different position method. If a vertical location 
co-ordinate is requested but the RAN can only obtain horizontal co-ordinates, these may be returned. 
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9.1.6.3 



Location Calculation and Release Procedure 



9) When location information best satisfying the requested location type and QoS has been obtained, the RAN 
returns it to the SGSN in a Location Report message. RAN shall in its response include an indication whether the 
obtained location estimate satisfies the requested accuracy or not. The information of the positioning method 
used may be returned with the location information. If a location estimate could not be obtained, the RAN 
returns a Location Report message containing a failure cause and no location estimate. 

10) The SGSN returns the location information, its age and obtained accuracy indication to the GMLC, if the SGSN 
has not initiated the Privacy Verification process in step 5. If step 5 has been performed for privacy verification, 
the SGSN returns the location information only, if it has received a LCS Location Notification Return Result 
indicating that permission is granted. In these cases, the information about the positioning method used may be 
sent with the location information. If a LCS Location Notification Return Result message indicating that 
permission is not granted is received, or there is no response, with the requested privacy action or the UE 
subscription profile indicating barring of location, the SGSN shall return an error response to the GMLC. If the 
SGSN did not return a successful location estimate, but the privacy checks were successfully executed, the 
SGSN may return the last known location of the target UE if this is known and the LCS client is requesting the 
current or last known location. The SGSN may record charging information. 

11) Common MT-LR procedure in PS and CS domain as described in 9.1.1. 

9.1 .7 Packet Switched Network Induced Location Request (PS-NI-LR) 

Figure 9.6 illustrates a network induced location request from the SGSN. This procedure may be used e.g. for 
positioning of an emergency call. 
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Figure 9.6: Network Induced Location Request 

1) The SGSN sends a Location Request message to the RAN. This message indicates the type of location 
information requested and requested QoS. 
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9.1 .7.1 Positioning Measurement Establishment Procedure 

2) If the requested location information and the location accuracy within the QoS can be satisfied based on 
parameters received from the SGSN and the parameters obtained by the RAN e.g. cell coverage and timing 
information (i.e. RTT or TA), the RAN may send a Location Report immediately. Otherwise, the RAN 
determines the positioning method and instigates the particular message sequence for this method. If the position 
method returns position measurements, the RAN uses them to compute a location estimate. If there has been a 
failure to obtain position measurements, the RAN may use the current cell information and, if available, RTT or 
TA value to derive an approximate location estimate. If an already computed location estimate is returned for an 
UE based position method, the RAN may verify consistency with the current cell and, if available, RTT or TA 
value. If the location estimate so obtained does not satisfy the requested accuracy and sufficient response time 
still remains, the RAN may instigate a further location attempt using the same or a different position method. If a 
vertical location co-ordinate is requested but the RAN can only obtain horizontal co-ordinates, these may be 
returned. 

9.1 .7.2 Location Calculation and Release Procedure 

3) When a location estimate best satisfying the requested QoS has been obtained, the RAN returns a Location 
Report to the SGSN with an indication whether the obtained location estimate satisfies the requested accuracy or 
not. This message carries the location estimate that was obtained. If a location estimate was not successfully 
obtained, a failure cause is included in the Location Report. 

4) The SGSN shall send a MAP Subscriber Location Report to the GMLC obtained in step 1 carrying the MSISDN 
of the UE, the identity of the LCS client, the event causing the location estimate (NI-LR-PS), the location 
estimate and its age and the indication received from RAN whether the obtained location estimate satisfies the 
requested accuracy or not. The serving cell identity or S AI of the UE may be sent with the location information. 
The SGSN may record charging information. 

5) The GMLC shall acknowledge receipt of the location estimate provided that it serves the identified LCS client 
and the client is accessible. 

6) The GMLC may transfer the location information to the LCS client either immediately or upon request from the 
client. The GMLC may record charging information. 

9.1 .8 Mobile Terminating Deferred Location Request - UE available event 

Figure 9.6a illustrates the procedures for a Deferred Location Request, where the Location Report is returned based on a 
UE available event. 
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Figure 9.6a: General Network Positioning for a Deferred MT-LR with UE available event 
9.1 .8.1 Deferred Location Request Procedure 

1) The LCS Service Request shall contain an indication of the requested event i.e. UE available. The R-GMLC 
assigns a LDR reference number to this LCS Service request. 

2) LCS service request handling between GMLCs as described in clause 9.1.1. The information received by the R- 
GMLC is transferred to the V-GMLC via the H-GMLC, including the LDR reference number and the H-GMLC 
address. 

3) The V-GMLC sends the UE available event to MSC/SGSN in the Provide Subscriber Location request (deferred) 
and includes the LDR reference number and the H-GMLC address in the request. 

Note: It shall be possible to issue the deferred location requests for the UE available event, even in case there is 
an ongoing previous MT-LR for the same UE. 

4) If the SGSN/MSC cannot support the deferred location request for the specified event (for temporary or 
permanent reasons), or if either the security or privacy check related actions fail, then a Provide Subscriber 
Location return error shall be returned with a suitable cause. If the SGSN/MSC can support the deferred location 
request for the specified event, a Provide Subscriber Location ack. shall be returned to the V-GMLC without a 
location estimate. The SGSN/MSC may record charging information for an accepted deferred location request. 

5) V-GMLC returns the LCS Service Response to H-GMLC to notify whether the request was successfully 
accepted or not. The V-GMLC may record charging information for an accepted deferred location request. 
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6) H-GMLC returns the LCS Service Response to R-GMLC to notify whether the request was successfully 
accepted or not. The H-GMLC may record charging information for an accepted deferred location request. 

7) The R-GMLC then returns the LCS Service Response to the LCS Client to notify whether the request was 
successfully accepted or not. When the R-GMLC returns the LCS Service Response to the LCS Client, the LDR 
reference number assigned by the R-GMLC shall be included. The R-GMLC may record charging information 
for an accepted deferred location request. 

9.1.8.2 Location Report Procedure 

8) Immediately following step 3, the SGSN/MSC shall verify if the requested event is already satisfied (e.g. UE 
available inferred from a current transaction) or can be invoked immediately (e.g. by paging the UE and 
receiving a page response). If the requested event is not already satisfied, the SGSN/MSC waits until it has 
occurred or until some maximum time has expired. 

In case the SGSN/MSC receives an indication that the UE has moved to another SGSN/MSC, while it is waiting 
for the requested event to happen, SGSN/MSC shall immediately send a Subscriber Location Report to the V- 
GMLC. The report shall include the reference number and H-GMLC address that were included in the Provide 
Subscriber Location request and the information that the MT-LR must be reinitiated against the new 
SGSN/MSC. It shall also include the address of the new SGSN/MSC, if available. If the V-GMLC is associated 
with the new MSC/SGSN, it re-issues the location request to the new MSC/SGSN. Otherwise the V-GMLC 
forwards the responses to the H-GMLC. If the H-GMLC already knows (e.g. from a previous location request or 
an internal lookup table), or is able to determine, (e.g. it is possible to use a DNS lookup mechanism similar to 
IETF RFC 2916), the network address of the V-GMLC it reinitiates the MT-LR to the new SGSN/MSC of the 
new V-GMLC. Otherwise, the H-GMLC shall then issue a SEND_ROUTING_INFO_FOR_LCS message to get 
the address of the V-GMLC associated with the new SGSN/MSC and reinitiate the MT-LR with the new 
SGSN/MSC through the new V-GMLC, see step 12. 

9) When the requested event is detected, the SGSN/MSC shall proceed with the location request as described in 
9.1.2/9.1.6. 

If either security or privacy check related actions fail, the SGSN/MSC shall send a Subscriber Location Report 
with the reference number and H-GMLC address that was included in the Provide Subscriber Location with 
appropriate error cause indicating termination of the deferred location request. 

10) When location information has been obtained from the RAN, the SGSN/MSC returns the Subscriber Location 
Report. The report shall include the reference number that was included in the Provide Subscriber Location, the 
H-GMLC address, an indication that this is a response to a previously sent deferred location request and may 
also include the indication whether the obtained location estimate satisfies the requested accuracy or not 
(provided that this indication is obtained from RAN with the location estimate). The SGSN/MSC may record 
charging information. 

If the location information could not be obtained, or the SGSN/MSC for some other reason decides to not wait 
any longer for the requested event to occur (ex. timer expires), the Subscriber Location Report with the reference 
number and H-GMLC address that was included in the Provide Subscriber Location will be returned with an 
appropriate error cause indicating termination of the deferred location request. 

1 1) V-GMLC sends the LCS Service Response to the H-GMLC with an indication of the event occurrence and the 
LDR reference number. The LCS Service Response is sent in accordance with the requested QoS Class, as 
described in clause 9.1.1 for common MT-LR. 

12) In case the LCS Service Response indicates to H-GMLC that the mobile has moved to another SGSN/MSC, the 
H-GMLC shall send the deferred MT-LR with UE available event to the V-GMLC (previous or new), which 
forwards the request to the new SGSN/MSC, as described in step 2 onwards. 

13) The H-GMLC performs the privacy check as described in clause 9.1.1. 

14) The H-GMLC sends the LCS Service Response to R-GMLC. 

15) The R-GMLC sends the LCS Service Response to the LCS Ghent. When the R-GMLC returns the LCS Service 
Response to the LCS Client, the LDR reference number that was sent to the LCS Client in step 3 shall be 
included. 
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9.1 .8.3 Combined Periodical/Deferred Mobile Terminating Location Request with UE 

available event 

Figure 9.6b illustrates the procedures for a Combined Periodical/Deferred Mobile Terminating Location Request with 
UE available event, where the response to the LCS client is returned periodically and based on the event. 

Note: In the description below, it is assumed that the LCS client issues the Periodical/Deferred MT-LR with 
only the location estimate type of 'current location'. 
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Figure 9.6b: General Network Positioning for a Combined Periodical/Deferred IVIT-LR 

1) When a R-GMLC receives a LCS Service Request from a LCS client, the R-GMLC verifies the identity of the 
LCS client as described in 9.LL 

2) The R-GMLC starts the periodical timer, and initiates the common LCS procedures as described in 9.1.1. 

3) The V-GMLC sends a Deferred Location Request to the SGSN/MSC by means of Provide Subscriber Location 
as described in 9.L2/9.L6. In addition, the Deferred Location Request includes the reference number assigned 
by the R-GMLC and the event that shall trigger the sending of Subscriber Location Report. 
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4) If the SGSN/MSC cannot support the deferred location request for the specified event or the LCS client is not 
allowed to position the requested UE according to subscription information, a Provide Subscriber Location error 
is returned to the V-GMLC. If the SGSN/MSC can support the deferred location request for the specified event 
and the privacy checks are satisfied, a Provide Subscriber Location ack shall be returned to the V-GMLC 
without a location estimate. The SGSN/MSC may record charging information for an accepted deferred location 
request. 

5) The V-GMLC then returns the LCS Service Response to the LCS Client via H-GMLC and R-GMLC to notify 
whether the request was successfully accepted or not. The V-GMLC, H-GMLC and R-GMLC may record 
charging information for an accepted deferred location request. When the R-GMLC returns the LCS Service 
Response to the LCS Client, the LDR reference number assigned by the R-GMLC shall be included. 

6) When the periodical timer expires, if the R-GMLC is still waiting for the event, the R-GMLC shall send a LCS 
Service Response to the LCS client, indicating that the location is not available at that moment. The LDR 
reference number that was sent to the LCS Client in step 5 shall be included in the response. 

7) When the requested event is detected, the SGSN/MSC will proceed with the location request as described in 
9.1. 2/9. L6. 

8) When location information has been obtained from the RAN, the SGSN/MSC returns the Subscriber Location 
Report. The report shall include the reference number included in the previously sent Provide Subscriber 
Location and an indication that this is a response to a previously sent deferred location request. The SGSN/MSC 
may record charging information. 

If the location information could not be obtained, or the SGSN/MSC for some other reason decides to not wait 
any longer for the requested event to occur (ex. timer expires), the Subscriber Location Report with the reference 
number included in the previously sent Provide Subscriber Location will be returned with an appropriate error 
cause indicating termination of the deferred location request. 

9) The V-GMLC then returns the LCS Service Response to the LCS Client via H-GMLC and R-GMLC as in 
9.1.2/9.1.6. When the R-GMLC returns the LCS Service Response to the LCS Client, the LDR reference number 
that was sent to the LCS Client in step 5 shall be included. 

10) When the timer expires, if the R-GMLC is not waiting for the event, the R-GMLC initiates the common LCS 
procedures as described in 9.LL The R-GMLC should use the same LDR reference number assigned in the step 
3, should NOT assign a new LDR reference number. 

11) Same as step 3. 

12) Same as step 4. 

13)Same as step 5. 

14) If the requested event is already satisfied, the SGSN/MSC will proceed with the location request as described in 
9.1.2/9.1.6. 

15)Same as step 8. 

16) Same as step 9. 
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9.1 .8.4 Cancellation of a Deferred Location Request - UE available event 















































GjViu_ 


G]Viu_ 


HLk/ 


GjVil*^ 


MSw 




RAN 




UE 


Client 




(Requesting) 




(Home) 




HSS 




(Visited) 




SGSN 
























































LLCS Cancel Servic 


; Request 














^ 


^ Request 














2. LCS Cancel Servic 












^ 

™ 






















3. LCS Cancel Serv 


ce Request 






her Location 






4. Provide Subscr 
















her Location ack. 






5. Provide Subsci 


































6. LCS Cancel Serv 


ce Response 




































^ 


7. IX;S Cancel Servics 


Response 














8. LCS Cancel Servict 


Response 

































Figure 9.6c: Cancellation of a Deferred MT-LR - UE available event procedure 

1) The LCS Client requests the cancellation of a previously requested Deferred Location Request. The LDR 
reference number that was included in the previous LCS Service Response sent by the GMLC shall be included 
in the request to indicate which outstanding LDR should be cancelled. 

2) The R-GMLC sends the cancellation request to H-GMLC, including the LDR reference number. The 
cancellation could be initiated by the R-GMLC itself for some reasons (e.g. the expiry of the validity timer 
specified by the start time and stop time; or the expiry of an implementation dependent timer specified by the 
Operator as a default value in the R-GMLC when the stop time is undefined or exceeds the maximum allowed 
value). 

3) The H-GMLC forwards the LCS Cancel Service Request to V-GMLC with the LDR reference number which is 
received from the R-GMLC, and the H-GMLC address. The H-GMLC may itself initiate the cancellation 
procedure, e.g. if an implementation dependent timer in the H-GMLC expired, or when the UE"s privacy profile 
stored in the H-GMLC or in the PPR was changed. For every outstanding Deferred Location Request against that 
UE, the H-GMLC shall perform or ask the PPR to perform a new privacy check based on the updated privacy 
profile. If the privacy check passes, i.e. the LCS Client is still allowed to position the target UE, the handling of 
the outstanding Deferred Location Request should be continued. Otherwise, if the privacy check does not pass, 
i.e. the Location estimate of the target UE is not allowed to be provided to the LCS Client, the H-GMLC shall 
initiate a cancellation procedure. 

Note: The H-GMLC shall know that the UE subscriber"s privacy profile has been changed in the PPR when the 
LCS Privacy Profile Update has been sent from PPR to H-GMLC as described in 9.LL2. 

4) The V-GMLC will indicate this cancellation request in the Provide Subscriber Location toward the SGSN/MSC. 
The Provide Subscriber Location shall include the H-GMLC address, and the reference number specified by 
LCS Client in the LCS Cancel Service Request. 

5) When the SGSN/MSC completes the cancellation procedure, it notifies it to the V-GMLC in the Provide 
Subscriber Location Ack (with no location estimate included). 

6) The V-GMLC sends the LCS Cancel Service Response to H-GMLC. 

7) H-GMLC sends the LCS Cancel Service Response to R-GMLC. H-GMLC may send the LCS Cancel Service 
Response to R-GMLC, even if the R-GMLC/LCS client has not requested the cancellation, see step 3. 

8) The R-GMLC sends the LCS Cancel Service Response to the LCS CUent. 
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9.1 .9 Deferred Location Request Procedure for the change of area event 

Figure 9-6d illustrates the procedures for a Deferred Location Request where the Location Report is returned to the 
network by the UE following a change of area event. An area event occurs when the UE leaves, enters or is within a 
target area as defined by geographical area, PLMN identity, country code or geopolitical name of the area. Details of 
the target area are contained in the LCS Service Request message, see clause 5.5.1. 

The PLMN operator may choose to use another mechanism (such as SIM Application Toolkit) for the transfer and 
detection mechanism of the Area Definition and change of area event information to the UE. In this case, the GMLCs 
handle steps 2 to 7 and 11 to 14 differently from that shown below. An alternative mechanism is detailed in Annex F 



aient 



GMLC 

(Requesting) 



1 . LCS Service Rec jest 



GMLC 

(Home) 



HLR/ 
HSS 



GMLC 

(Visited) 



Msa 

SGSN 



2. LCS service request handling between GIVILCs 



10. LCS Service Response 



18. LCS Service Response 



9. LCS Service Res xinse 



8. LCS Service R Jsponse 



1 4. LCS Service F lesponse 



3. Provide Subsc riber Location 



RAN 



UE 



4. Paging, Autlientication, Notification 



7. Provide Sub; icriber Location i ck. 



13a. Subscriber 

H 

13b. Subscriber 



5. LCS Area E\ ent Invoke 



6. LCS Area E\ 



12. LCS Area ^vent Report 
Location Report 

Location Report \ck. 



'ent Invoke ack. 



11. Area event occurs; 



1 5. Repeat sending the Area Event Request to the new PLMN (Only applicable to the roaming case) 



16. Privacy check 



1 7. LCS Service Re sponse 



Figure 9.6d: Deferred MT-LR procedure for the Area event 

1) The LCS Service Request contains the change of area type deferred location request information, i.e. details of 
the target area and the nature of the event, whether the event to be reported is the UE being inside, entering into 
or leaving the target area. The LCS service request may specify the validity time, i.e. start time and stop time, for 
the deferred location request and R-GMLC may cancel the deferred location request as described in clause 
9.1.9.1. In addition, when validity time of a pending area event request in the target UE expires, the UE shall 
delete the pending deferred location request. The LCS Service Request shall contain an indication of the 
minimum interval time between area event reports, if applicable. The LCS service request shall contain the 
information whether the deferred area event may be reported one time only, or several times. If the change of 
area event is reported one time only, the Location Service request shall be completed after the first area event has 
occurred. The R-GMLC assigns a LDR reference number to this LCS Service request. If the target area is 
expressed by local coordinate system or geopolitical name, the R-GMLC shall convert the target area to 
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geographical area expressed by a shape defined in TS 23.032 [1 1]. In addition to the target area definition, the 
LCS Client may include the country code of the target area in the area event request. 

2) LCS service request handling between GMLCs as described in clause 9.1.1. If indication of the requested 
location estimate is included in the area event request, the R-GMLC should record this indication and any 
relevant parameters such as QoS. The information received by the R-GMLC is transferred to the V-GMLC via 
the H-GMLC, including the LDR reference number and the H-GMLC address. 

If the H-GMLC notices that the current visited PLMN does not serve the target area, it may generate a modified 
deferred LCS service request in order to get notified when the target UE enters a PLMN that serves the target 
area. The modified target area event is that the target UE enters one of the PLMNs that serve the original target 
area. Note that the new area event may include multiple PLMNs (identified by PLMN IDs) if there are more 
than one PLMN that serves the original target area, based on the stored PLMN list and the corresponding 
estimated coverage. The H-GMLC then generates a new location request with the new defined area event and 
the same rest of the information in the original request. 

The new location request is sent to the target UE via the current V-GMLC. The H-GMLC keeps the original 
area event location service request pending for as long as determined by the validity time of the request. When 
the UE enters one of the pre-defined PLMNs, it sends an area event location report to H-GMLC. The H-GMLC 
then sends the original area event location service request to the UE via the new V-GMLC. If the H-GMLC 
cannot derive a list of PLMNs that may cover the target area, and the current visited network does not cover the 
target area, the H-GMLC may reject the request. 

3) If the received target area is expressed by a shape defined in TS 23.032 [11], V-GMLC converts the target area 
into an Area Definition consisting of the corresponding list of cell identities, location areas or routing area. If the 
V-GMLC is not able to translate the target area into network identities, it shall reject the request and send an 
LCS service response to H-GMLC with the appropriate error cause. 

If the received target area is expressed by country code or PLMN identity, the V-GMLC shall use the country 

code or PLMN identity as the Area Definition. 

The V-GMLC sends the Area Definition to MSC/SGSN in the Provide Subscriber Location request (deferred) 

and includes the LDR reference number and the H-GMLC address in the request. 

The message shall define whether the event to be reported is the UE being inside, entering into or leaving the 

area. The message shall also include the validity period of the location request, the minimum interval time 

between area event reports, the information whether the deferred area event may be reported one time only or 

several times, if applicable. 

4) The MSC/SGSN verifies the UE capabilities with regard to the change of area event. If either the MSC/ SGSN 
or the UE does not support the deferred location request for the change of area event (for temporary or 
permanent reasons), a Provide Subscriber Location return error shall be returned with a suitable cause in step 7. 
If the UE is in idle mode, the core network performs paging, authentication and ciphering. If privacy 
notification/verification is requested, the MSC/SGSN sends an LCS Location Notification Invoke message to the 
target UE indicating the change of area type deferred location request and whether privacy verification is 
required. LCS Location Notification is further specified in clauses 9.1.2 and 9.1.6. If privacy verification was 
requested, the UE returns an LCS Location Notification Return Result to the MSC/SGSN indicating whether 
permission is granted or denied. 

5) The MSC/SGSN sends the LCS Area Event Invoke to the UE carrying the Area Definition, other area event 
information, the LDR reference number and the H-GMLC address. The message shall also define whether the 
event to be reported is the UE being inside, entering into, leaving the area. The message shall also include the 
validity period of the location request, the minimum interval time between area event reports and the information 
whether the deferred area event may be reported one time only, or several times, if applicable. 

6) If the LCS Area Event Invoke is successfully received by the UE and the UE supports the change of area type 
deferred location request, the UE sends acknowledgement to MSC/SGSN and begins monitoring for the change 
of area event. The UE shall determine whether it is inside, entering into or leaving the target area by comparing 
the current serving cell identity, location area, routing area, PLMN identity or country code to the Area 
Definition received from the MSC/SGSN. In case of soft handover, it is sufficient if one of the cells belongs to 
the target area. In case the Area Definition consists of a location or routing area, PLMN or country identity the 
UE shall check for the area event during the normal location or routing area update procedure. The change of 
area event detection mechanism must not influence on the normal UE cell selection and reselection procedures. 
If the UE does not support the deferred location request (for temporary or permanent reasons), it shall send the 
LCS Area Event Invoke ack. with the appropriate error cause. 
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7) If either the MSC/ SGSN or the UE does not support the deferred location request for the change of area event 
(for temporary or permanent reasons), a Provide Subscriber Location return error shall be returned to the V- 
GMLC with a suitable cause. If both of the SGSN/MSC and UE supports the deferred location request for the 
change of area event, a Provide Subscriber Location ack. shall be returned to the V-GMLC without a location 
estimate. MSC/SGSN shall include the result of the notification/verification in the response to the V-GMLC, if 
the notification/verification is needed. The response message shall include the LDR reference number and the H- 
GMLC address. The change of area event invoke result shall be also included, if necessary. After sending the 
Provide Subscriber Location ack to the V-GMLC, the deferred location request shall be completed in the 
MSC/SGSN. The SGSN/MSC may record charging information for an accepted area event request. 

8) to 10) V-GMLC returns the LCS Service Response via H-GMLC and R-GMLC to the LCS Client to notify 

whether the request was successfully accepted or not. When the R-GMLC returns the LCS Service Response to 
the LCS Client, the LDR reference number assigned by the R-GMLC shall be included. After sending the LCS 
Service Response to the H-GMLC, the deferred location request shall be completed in the V-GMLC. The V- 
GMLC or R-GMLC may record charging information for an accepted area event request. 

1 1)UE detects that the requested area event has occurred. 

12) Before sending the LCS Area Event Report the UE shall establish either a CS radio connection or PS signalling 
connection as specified in clauses 9.2.1 and 9.2.2. The UE sends the LCS Area Event Report to the 
VMSC/SGSN including the original LDR reference number and the H-GMLC address. The report shall also 
include the result of the notification/verification procedure, if the notification/verification is needed. 

When the MSC/SGSN receives the report and it can handle this report, an acknowledgement as a response 
should be sent to the UE. If the UE does not receive any response from the MSC/SGSN after sending the report, 
i.e. the current MSC/SGSN does not support the deferred location request for the area event (for temporary or 
permanent reasons), the UE may re-send the report more times. If the UE always does not receive the response, 
the UE shall stop sending the report, then record a corresponding flag to indicate that a report has been sent 
unsuccessfully. When the UE performs location update and detects the LAI or RA is changed, if the flag has 
been set, the UE shall send the report to the corresponding MSC/SGSN, and the flag will be cleared upon a 
success of the sending. 

If the UE was requested to report the change of area event one time only, the deferred location request shall be 
completed. In case multiple reports were requested, the UE must not send a repeated LCS Area Event Report 
more often than the requested minimum interval indicated in the LCS Area Event Invoke. 

Editor"s Note: It could be useful to have MSC/SGSN repeat the notification procedure with the target UE after the 
UE has reported the change of area event, but this is for further study. 

13) The MSC/SGSN sends the subscriber location report to its associated V-GMLC with an indication of the event 
occurrence, the LDR reference number, the H-GMLC address and may also include the indication whether the 
obtained location estimate satisfies the requested accuracy or not (provided that this indication is obtained from 
RAN with the location estimate). V-GMLC sends an acknowledgement to MSC/SGSN in step 13b and the 
MSC/SGSN may record charging information. 

14) The V-GMLC sends the LCS Service Response to the H-GMLC with an indication of the event occurrence, the 
LDR reference number and the H-GMLC address. The LCS Service Response is sent in accordance with the 
requested QoS Class, as described in clause 9.1.1 for common MT-LR. The LDR reference number and the H- 
GMLC address will be used to identify the source of the original deferred location request in the case that the UE 
has relocated before the area event occurred. The V-GMLC may record charging information. 

15)In case the UE moves to another PLMN of the PLMN identities list, according to the PLMN identity the UE 
shall determine whether the Area Definition of the target area is available. If it is not available, the UE shall 
report that it has roamed into a new PLMN, including the new PLMN identity and the LDR reference number. 
The H-GMLC shall transfer the original area event request to the V-GMLC of the new PLMN. The procedure 
should be continued as described in step 2 and onwards where the Area Definition of the new PLMN shall be 
downloaded to the UE. Otherwise, the UE monitors the area event in the new PLMN, does not inform the H- 
GMLC that it has entered into a new PLMN. 

16)The H-GMLC performs the privacy check as described in clause 9.1.1. 

17)The H-GMLC sends the LCS Service Response to R-GMLC. Unless multiple reports were requested, the 

deferred location request shall be completed in the H-GMLC after sending the LCS Service Response to the R- 
GMLC. The H-GMLC may record charging information. 



ETSI 



3GPP TS 23.271 version 6.10.0 Release 6 



75 



ETSI TS 123 271 V6.10.0 (2004-12) 



18) If the R-GMLC finds the indication of the requested location estimate is stored, the R-GMLC should generate a 
new immediate LCS Service Request with the QoS specified in the original request. Then the R-GMLC sends 
the new request to the H-GMLC and waits the result the location request. The H-GMLC performs the privacy 
check as described in clause 9.1.1, and the subsequent procedures in clause 9.1.1 are continued. 

The R-GMLC sends the LCS Service Response to the LCS client, the LDR reference number that was sent to the 
LCS Client in step 10 shall be included in the response. If the location estimate of the target UE is requested in 
the request and the location estimate was successfully obtained, the R-GMLC shall put the obtained location 
estimate into the LCS Service Response. If the location estimate of the target UE is requested in the request but 
the location estimate could not be obtained, the R-GMLC sends the LCS Service Response without the location 
estimate. Unless multiple reports were requested, the deferred location request shall be completed in the R- 
GMLC after sending the LCS Service Response to the LCS client. The R-GMLC may record charging 
information. 

9.1 .9.1 Cancellation of a Deferred Location Request - Change of Area event 

Figure 9-7b illustrates the procedure for cancelling the Deferred Location Request for the change of area event. 
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Figure 9.7b: Cancellation of a Deferred MT-LR with change of area event procedure 

1) The LCS Client requests the cancellation of a previously requested Deferred Location Request. The LDR 
reference number that was included in the previous LCS Service Response sent by the GMLC shall be included 
in the request to indicate which outstanding LDR should be cancelled. 

2) The R-GMLC sends the cancellation request to H-GMLC, including the LDR reference number. R-GMLC may 
itself initiate the cancellation for some other reason, e.g. the expiry of the validity timer specified by the start 
time and stop time; or the expiry of an implementation dependent timer specified by the Operator as a default 
value in the R-GMLC when the stop time is undefined or exceeds the maximum allowed value. 

3) The H-GMLC forwards the LCS Cancel Service Request to V-GMLC with the LDR reference number which is 
received from the R-GMLC, and the H-GMLC address. The H-GMLC may itself initiate the cancellation 
procedure, when the UE"s privacy profile stored in the H-GMLC or in the PPR was changed. For every 
outstanding Deferred Location Request against that UE, the H-GMLC shall perform or ask the PPR to perform a 
new privacy check based on the updated privacy profile. If the privacy check passes, i.e. the LCS Client is still 
allowed to position the target UE, the handling of the outstanding Deferred Location Request should be 
continued. Otherwise, if the privacy check does not pass, i.e. the Location estimate of the target UE is not 
allowed to be provided to the LCS Client, the H-GMLC shall initiate a cancellation procedure. 
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Note: The H-GMLC shall know that the UE subscriber"s privacy profile has been changed in the PPR when the 
LCS Privacy Profile Update has been sent fi^om PPR to H-GMLC as described in 9.1.1.2. 

4) The V-GMLC sends the Provide Subscriber Location request to SGSN/MSC, indicating a cancellation of a 
deferred location request and including the LDR reference number specified by the LCS Client in the LCS 
Cancel Service Request and the H-GMLC address received from the H-GMLC. 

5) The SGSN/MSC sends the LCS Area Event Cancellation, including the LDR reference number and the H- 
GMLC address, request to UE. 

6a) The UE cancels the Area event deferred location request and sends the LCS Area Event cancellation ack., with 
no area event information included to VMSC/SGSN. 

6b) While the UE is monitoring for the area event to occur, the UE may cancel or terminate the deferred location 
request for the change of area on its own behalf by sending the LCS Area Event report with the LDR reference 
number, an indication of the cancellation and an appropriate error cause. 

7) The SGSN/MSC sends the cancellation acknowledgement to the V-GMLC in the Provide Subscriber Location 
Ack, with the LDR reference number and the H-GMLC address. 

8) The V-GMLC sends the LCS Cancel Service Response to H-GMLC with the LDR reference number and the H- 
GMLC address. 

9) H-GMLC sends the LCS Cancel Service Response to R-GMLC with the LDR reference number. H-GMLC may 
send the LCS Cancel Service Response to R-GMLC, even if the R-GMLC/LCS client has not requested the 
cancellation, see step 3. 

10) R-GMLC sends the LCS Cancel Service Response to the LCS Client. 

9.2 Mobile Originating Location Request 

9.2.1 IVIobile Originating Location Request, Circuit Switclned (CS-IVIO-LR) 

The following procedure shown in figure 9.7 allows an UE to request either its own location, location assistance data or 
broadcast assistance data message ciphering keys from the network. Location assistance data may be used subsequently 
by the UE to compute its own location throughout an extended interval using a mobile based position method. The 
ciphering key enables the UE to decipher other location assistance data broadcast periodically by the network. The 
MO-LR after location update request may be used to request ciphering keys or GPS assistance data using the follow-on 
procedure described in TS 24.008 [24]. The procedure may also be used to enable an UE to request that its own location 
be sent to an external LCS client. 
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Figure 9.7: General Network Positioning for CS-MO-LR 



Location Preparation Procedure 



1) If the UE is in idle mode, the UE requests a radio connection setup and sends a CM service request indicating a 
request for a call independent supplementary services to the VMSC/MSC server via RAN. 

2) RAN shall convey the CM service request to the core network. If the UE is in dedicated mode, the UE sends a 
CM Service Request on the already established radio connection. 

3) The VMSC/MSC server instigates authentication and ciphering if the UE was in idle mode or returns a Direct 
Transfer CM Service Accept if the UE was in dedicated mode. The UE will inform the network about its LCS 
capabilities, as described in chapter 6.3.4. 
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4) The UE sends a LCS CS-MO-LR Location Services invoke to the VMSC/MSC server. Different types of 
location services can be requested: location of the UE, location of the UE to be sent to an external LCS client, 
location assistance data or broadcast assistance data message ciphering keys. If the UE is requesting its own 
location or that its own location be sent to an external LCS client, this message carries LCS requested QoS 
information (e.g. accuracy, response time, LCS QoS Class), the requested maximum age of location and the 
requested type of location (e.g. 'current location', 'current or last known location'). If the UE is requesting that its 
location be sent to an external LCS client, the message shall include the identity of the LCS client and may 
include the address of the GMLC through which the LCS client should be accessed. In addition, a Service 
Identity indicates which MO-LR service of the LCS Client is requested by the UE may be included. The message 
also may include a pseudonym indicator to indicate a pseudonym should be assigned by the network and 
transferred to the LCS Client as the UE"s identity. If the UE is instead requesting location assistance data or 
ciphering keys, the message specifies the type of assistance data or deciphering keys and the positioning method 
for which the assistance data or ciphering applies. For an LCS CS-MO-LR Location Services invoke, the 
VMSC/MSC server shall assign a GMLC address, i.e. V-GMLC address, which is stored in the VMSC/MSC 
server. If a V-GMLC address is not available, the VMSC/MSC server may reject the location request. The 
VMSC/MSC server verifies in the UE's subscription profile that the UE has permission to request its own 
location, request that its location be sent to an external LCS client or request location assistance data or 
deciphering keys (whichever applies). If the UE is requesting positioning and has an established call, the 
VMSC/MSC server may reject the request for certain non-speech call types. 

5) In case the requested type of location is 'current or last known location' and the requested maximum age of 
location information is sent from UE, the VMSC/MSC server verifies whether it stores the previously obtained 
location estimate of the target UE. If the VMSC/MSC server stores the location estimate and the location 
estimate satisfies the requested maximum age of location, this step and steps 6 and 7 may be skipped. Otherwise 
the VMSC/MSC server sends a Location Request message to RAN associated with the Target UE. The message 
indicates whether a location estimate or location assistance data is requested and, in GSM, includes the UE's 
location capabilities. If the UE's location is requested, the message also includes the requested QoS. If location 
assistance data is requested, the message carries the requested types of location assistance data. 

9.2.1 .2 Positioning Measurement Establishment Procedure 

6) If the UE is requesting its own location, RAN determines the positioning method and instigates the particular 
message sequence for this method, as specified in UTRAN Stage 2, TS 25.305 [1] and GERAN Stage 2, TS 
43.059 [16]. If the UE is instead requesting location assistance data, RAN transfers this data to the UE as 
described in subsequent clauses in TS 25.305 [1] and TS 43.059 [16] UE. 

9.2.1 .3 Location Calculation and Release Procedure 

7) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, RAN returns a Location Report to the VMSC/MSC server with an 
indication whether the obtained location estimate satisfies the requested accuracy or not. This message carries 
the location estimate or ciphering keys if this was obtained. If a location estimate or deciphering keys were not 
successfully obtained or if the requested location assistance data could not be transferred successfully to the UE, 
a failure cause is included in the Location Report. 

8) If the location estimate was successfully obtained, the VMSC/MSC server shall send a MAP Subscriber 
Location Report to the V-GMLC assigned in the step 4, carrying the MSISDN/IMSI of the UE, the event 
causing the location estimate (CS-MO-LR) and the location estimate, its age, obtained accuracy indication and 
the LCS QoS Class requested by the target UE. In addition, the MAP Subscriber Location Report may include 
the pseudonym indicator, the identity of the LCS Client, the GMLC address and the Service Identity specified by 
the UE, if available. 

9) Upon receipt of the MAP Subscriber Location Report, the V-GMLC shall determine whether the UE requests 
transfer of its location to an external LCS Client. If the identity of the LCS Client is not available, this step and 
steps 10 to 14 are skipped. Otherwise, the V-GMLC shall send the MO-LR Location Information to the H- 
GMLC (the V-GMLC may query the HLR/HSS of the UE to obtain the address of the H-GMLC), carrying the 
MSISDN/IMSI of the UE, the event causing the location estimate (CS-MO-LR), the location estimate and its 
age and the identity of the LCS Client. The pseudonym indicator and/or the GMLC address specified by the UE 
may also be included if available. 

10) If the pseudonym indicator is included in the MO-LR Location Information, the H-GMLC assigns or asks the 
PMD to assign a pseudonym to the UE. If the identity of the LCS Client and the GMLC address access to the 
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LCS Client are available, the H-GMLC shall send the MO-LR Location Information to the specified GMLC. If 
the identity of the LCS Client is available but the GMLC address access to the LCS Client is not available, the 
H-GMLC determines whether the specified LCS Client is accessible. If yes, the H-GMLC shall send the 
Location Information to the LCS Client, then the H-GMLC itself act as the specified GMLC, this step and step 
13 are skipped. If not, according to the LCS Client identity, the H-GMLC shall determine a GMLC that can 
access the LCS CUent, and send the MO-LR Location Information to the GMLC, carrying the MSISDN or the 
pseudonym of the UE, the identity of the LCS client, the event causing the location estimate (CS-MO-LR), 
location estimate and its age. 

1 l)If the identified LCS Client is not accessible, this step and step 12 are skipped. Otherwise the GMLC transfers 
the location information to the LCS client, carrying the MSISDN/IMSI or the pseudonym of the UE, the event 
causing the location estimate (CS-MO-LR), the Service Identity, if available, and the location estimate and its 
age, in accordance with the LCS QoS Class requested by the target UE. If the UE requested LCS QoS class was 
Assured, GMLC sends the result to the LCS client only if the result has been indicated to fulfil the requested 
accuracy. If the UE requested LCS QoS class was Best Effort, GMLC sends whatever result it received to the 
LCS client with an appropriate indication if the requested accuracy was not met. 

12) If the LCS Client does not support MO-LR (for temporary or permanent reasons) or can not handle the location 
estimate of the UE, e.g. the LCS Client does not know the Service Identity, or the UE does not register to the 
LCS Client, the LCS Client have no corresponding data of the UE, the LCS Client shall return the Location 
Information ack message to the GMLC or the H-GMLC (in case the LCS Client received Location Information 
is sent from H-GMLC) with a suitable error cause. Otherwise, the LCS Client handles the location estimate 
according to the Service Identity, sends the GMLC or the H-GMLC the Location Information ack message 
signalling that the location estimate of the UE has been handled successfully. 

13) If the identified LCS Client is not accessible, the GMLC sends MO-LR Location Information Acknowledgement 
to the H-GMLC with an appropriate error cause. Otherwise, the GMLC shall send MO-LR Location Information 
Acknowledgement to the H-GMLC. The message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 12. 
The GMLC may record charging information both for the LCS Client and inter-operator revenue charges. 

14) In case the H-GMLC receives the MO-LR Location Information Acknowledgement from the GMLC, it shall 
forward the MO-LR Location Information Acknowledgement from the GMLC to the V-GMLC, and record 
charging information both for the UE and inter-working revenue charges. 

In case the H-GMLC receives the Location Information Acknowledgement from the LCS Client, it shall send MO- 
LR Location Information Acknowledgement to the V-GMLC. The message shall specify whether the location 
estimate of the UE has been handled successfully by the identified LCS Client, and if not, the corresponding 
error cause obtained in step 12. The H-GMLC shall record charging information both for the UE and inter- 
working revenue charges. 

15) In case the V-GMLC receives the MO-LR Location Information Acknowledgement from the H-GMLC, the V- 
GMLC shall record charging information both for the UE and inter-working revenue charges and send the MAP 
Subscriber Location Report Acknowledgement to the VMSC/MSC server, carrying the information specifies 
whether the location estimate of the UE has been handled successfully by the identified LCS Client, and if not 
success, the corresponding error cause obtained in step 14. 

In case the V-GMLC receives the MAP Subscriber Location Report from the VMSCA^ISC server and it is not 
required to send to any LCS Client, the V-GMLC shall record charging information for the UE and response the 
MAP Subscriber Location Report Acknowledgement to the VMSC/MSC server. 

16) The VMSC/MSC server returns a CS-MO-LR Return Result to the UE carrying any location estimate requested 
by the UE including the indication received from RAN whether the obtained location estimate satisfies the 
requested accuracy or not, ciphering keys or an indicator whether a location estimate was successfully 
transferred to the identified LCS client. If the location estimate was successfully transferred to the identified LCS 
Client, the CS-MO-LR Return Result message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 15. 

17) The VMSC/MSC server may release the CM, MM and radio connections to the UE, if the UE was previously 
idle, and the VMSC/MSC server may record charging information. 
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9.2.2 Mobile Originating Location Request, Pacl^et Switclned (PS-MO-LR) 

The following procedure shown in figure 9.8 allows an UE to request either its own location; location assistance data or 
broadcast assistance data message ciphering keys from the network. Location assistance data may be used subsequently 
by the UE to compute its own location throughout an extended interval using a mobile based position method. A 
ciphering key enables the UE to decipher other location assistance data broadcast periodically by the network. The 
PS-MO-LR may be used to request ciphering keys or GPS assistance data. The procedure may also be used to enable an 
UE to request that its own location be sent to an external LCS client. 
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Figure 9.8: General Network Positioning for packet switched MO-LR 



Location Preparation Procedure 



1) In UMTS, if the UE is in idle mode, the UE requests a PS signaling connection and sends a Service request 
indicating signaling to the SGSN via the RAN. If the UE already has PS signaling connection, the UE does not 
need to send Service request. Security functions may be executed. These procedures are described in 

TS 23.060 [15]. In GSM this signaling step is not needed. 

2) The UE sends a LCS PS-MO-LR Location Services invoke message to the SGSN. Different types of location 
services can be requested: location of the UE, location of the UE to be sent to an external LCS client, location 
assistance data or broadcast assistance data message ciphering keys. If the UE is requesting its own location or 
that its own location be sent to an external LCS client, this message carries LCS requested QoS information (e.j 
accuracy, response time, LCS QoS Class), the requested maximum age of location and the requested type of 
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location (e.g. 'current location', 'current or last known location'). If the UE is requesting that its location be sent 
to an external LCS client, the message shall include the identity of the LCS client and may include the address of 
the GMLC through which the LCS client should be accessed. In addition, a Service Identity indicates which 
MO-LR service of the LCS Client is requested by the UE may be included. The message also may include a 
pseudonym indicator to indicate a pseudonym should be assigned by the network and transferred to the LCS 
Client as the UE"s identity. If the UE is instead requesting location assistance data or ciphering keys, the 
message specifies the type of assistance data or deciphering keys and the positioning method for which the 
assistance data or ciphering applies. For an LCS PS-MO-LR Location Services invoke, the SGSN shall assign a 
GMLC address, i.e. V-GMLC address, which is stored in the SGSN. If a V-GMLC address is not available, the 
SGSN may reject the location request. The SGSN verifies the subscription profile of the UE and decides if the 
requested service is allowed or not. 

3) In case the requested type of location is 'current or last known location' and the requested maximum age of 
location information is sent from UE, the SGSN verifies whether it stores the previously obtained location 
estimate of the target UE. If the SGSN stores the location estimate and the location estimate satisfies the 
requested maximum age of location, this step and steps 4 and 5 may be skipped. Otherwise the SGSN sends a 
Location Request message to the RAN associated with the Target UE's location. The message indicates whether 
a location estimate or location assistance data is requested. If the UE's location is requested, the message also 
includes the requested QoS. If location assistance data is requested, the message carries the requested types of 
location assistance data. The message carries also location parameters received in the Service Invoke message. 

9.2.2.2 Positioning Measurement Establishment Procedure 

4) If the UE is requesting its own location, the actions described in UTRAN Stage 2, TS 25.305 [1] or GERAN 
stage 2 TS 43.059 [16] are performed. If the UE is instead requesting location assistance data, the RAN transfers 
this data to the UE as described in subsequent clauses. The RAN determines the exact location assistance data to 
transfer according to the type of data specified by the UE, the UE location capabilities and the current cell. 

9.2.2.3 Location Calculation and Release Procedure 

5) When a location estimate best satisfying the requested QoS has been obtained or when the requested location 
assistance data has been transferred to the UE, the RAN returns a Location Report to the SGSN with an 
indication whether the obtained location estimate satisfies the requested accuracy or not. This message carries 
the location estimate or ciphering keys if this was obtained. If a location estimate or deciphering keys were not 
successfully obtained or if the requested location assistance data could not be transferred successfully to the UE, 
a failure cause is included in the Location Report. 

6) If the location estimate was successfully obtained, the SGSN shall send a MAP Subscriber Location Report to 
the V-GMLC assigned in the step 2, carrying the MSISDN/IMSI of the UE, the event causing the location 
estimate (PS-MO-LR) and the location estimate, its age, obtained accuracy indication and the LCS QoS Class 
requested by the target UE. In addition, the MAP Subscriber Location Report may include the pseudonym 
indicator, the identity of the LCS Client, the GMLC address and the Service Identity specified by the UE, if 
available. 

7) Upon receipt of the MAP Subscriber Location Report, the V-GMLC shall determine whether the UE requests 
transfer of its location to an external LCS Client. If the identity of the LCS Client is not available, this step and 
steps 8 to 12 are skipped. Otherwise, the V-GMLC shall send the MO-LR Location Information to the H-GMLC 
(the V-GMLC may query the HLR/HSS of the UE to obtain the address of the H-GMLC), carrying the 
MSISDN/IMSI of the UE, the event causing the location estimate (PS-MO-LR), the location estimate and its 
age, and the identity of the LCS Client. The pseudonym indicator and/or the GMLC address specified by the UE 
may also be included if available. 

8) If the pseudonym indicator is included in the MO-LR Location Information, the H-GMLC assigns or asks the 
PMD to assign a pseudonym to the UE. If the identity of the LCS Client and the GMLC address access to the 
LCS Client are available, the H-GMLC shall send the MO-LR Location Information to the specified GMLC. If 
the identity of the LCS Client is available but the GMLC address access to the LCS Client is not available, the 
H-GMLC determines whether the specified LCS Client is accessible. If yes, the H-GMLC shall send the 
Location Information to the LCS Client, then the H-GMLC itself act as the specified GMLC, this step and step 
1 1 are skipped. If not, according to the LCS Client identity, the H-GMLC shall determine a GMLC that can 
access the LCS Client, and send the MO-LR Location Information to the GMLC, carrying the MSISDN or the 
pseudonym of the UE, the identity of the LCS client, the event causing the location estimate (PS-MO-LR), 
location estimate and its age. 
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9) If the identified LCS Client is not accessible, this step and step 10 are skipped. Otherwise the GMLC transfers 
the location information to the LCS client, carrying the MSISDN/IMSI or the pseudonym of the UE, the event 
causing the location estimate (PS-MO-LR), the Service Identity, if available, and the location estimate and its 
age, in accordance with the LCS QoS Class requested by the target UE. If the UE requested LCS QoS class was 
Assured, GMLC sends the result to the LCS client only if the result has been indicated to fulfil the requested 
accuracy. If the UE requested LCS QoS class was Best Effort, GMLC sends whatever result it received to the 
LCS client with an appropriate indication if the requested accuracy was not met. 

10) If the LCS Client does not support MO-LR (for temporary or permanent reasons) or can not handle the location 
estimate of the UE, e.g. the LCS Client does not know the Service Identity, or the UE does not register to the 
LCS Client, the LCS Client have no corresponding data of the UE, the LCS Client shall return the Location 
Information ack message to the GMLC or the H-GMLC (in case the LCS Client received Location Information 
is sent from H-GMLC) with a suitable error cause. Otherwise, the LCS Client handles the location estimate 
according to the Service Identity, sends the GMLC or the H-GMLC the Location Information ack message 
signalling that the location estimate of the UE has been handled successfully. 

11) If the identified LCS Client is not accessible, the GMLC sends MO-LR Location Information Acknowledgement 
to the H-GMLC with an appropriate error cause. Otherwise, the GMLC shall send MO-LR Location Information 
Acknowledgement to the H-GMLC. The message shall specify whether the location estimate of the UE has been 
handled successfully by the identified LCS Client, and if not, the corresponding error cause obtained in step 10. 
The GMLC may record charging information both for the LCS Client and inter-operator revenue charges. 

12) In case the H-GMLC receives the MO-LR Location Information Acknowledgement from the GMLC, it shall 
forward the MO-LR Location Information Acknowledgement from the GMLC to the V-GMLC, and record 
charging information both for the UE and inter-working revenue charges. 

In case the H-GMLC receives the Location Information Acknowledgement from the LCS Client, it shall send 
MO-LR Location Information Acknowledgement to the V-GMLC. The message shall specify whether the 
location estimate of the UE has been handled successfully by the identified LCS Client, and if not, the 
corresponding error cause obtained in step 10. The H-GMLC shall record charging information both for the UE 
and inter-working revenue charges. 

13) In case the V-GMLC receives the MO-LR Location Information Acknowledgement from the H-GMLC, the V- 
GMLC shall record charging information both for the UE and inter-working revenue charges and send the MAP 
Subscriber Location Report Acknowledgement to the SGSN, carrying the information specifies whether the 
location estimate of the UE has been handled successfully by the identified LCS Client, and if not success, the 
corresponding error cause obtained in step 12. 

In case the V-GMLC receives the MAP Subscriber Location Report from the SGSN and it is not required to send 
to any LCS Client, the V-GMLC shall record charging information for the UE and response the MAP Subscriber 
Location Report Acknowledgement to the SGSN. 

14) The SGSN returns a Service Response message to the UE carrying any location estimate requested by the UE 
including the indication received from RAN whether the obtained location estimate satisfies the requested 
accuracy or not, ciphering keys or an indicator whether a location estimate was successfully transferred to the 
identified LCS client. If the location estimate was successfully transferred to the identified LCS Client, the 
Service Response message shall specify whether the location estimate of the UE has been handled successfully 
by the identified LCS Client, and if not, the corresponding error cause obtained in step 13. The SGSN may 
record charging information. 

9.3 LCS signaling procedures specified in UTRAN and GERAN 
Stage 2 

The signaling procedures in UTRAN and GERAN are defined in TS 25.305 [1] and TS 43.059 [16] respectively. 



9.4 Exception Procedures 



The procedures in this clause apply to all variants of an MT-LR, NI-LR and MO-LR where a Location Request message 
has been sent to RAN requesting some location service (e.g. provision of a location estimate for a target UE or transfer 
of assistance data to a target UE). 
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9.4.1 Procedures in the VMSC /MSC server 

After the VMSC /MSC server has requested a location service for a particular UE from RAN, certain events may occur 
that may temporarily or permanently interfere with the location service attempt. For each such event notified to the 
VMSC /MSC server, the VMSC /MSC server shall employ one of the following error recovery actions. 

Restart the Location Service 

This action shall be employed for any event that temporarily impedes a location service attempt and cannot be delayed 
until the location service attempt is complete. When such an event is notified to the VMSC /MSC server, it shall 
immediately cancel the location service attempt and the associated signaling dialogue with RAN, if this still exists by 
sending a "stop reporting" message to RAN. The "stop reporting" message shall contain the reason for the location 
procedure cancellation in A/Gb mode or the indication about the type of location request to cancel (e.g. direct) in lu 
mode. 

After aborting the location request dialogue with RAN, the VMSC /MSC server may queue the location service request 
until the event causing the restart has terminated (if not already terminated). The VMSC /MSC server may optionally 
wait for an additional time period (e.g. if the queuing delay is minimal) to ensure that any resources allocated in and by 
RAN have time to be released. The VMSC /MSC server may then send another location service request to RAN 
associated with the target UE. 

Abort the Location Service 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
dedicated signaling channel to the target UE. When such an event is notified to the VMSC /MSC server, it shall cancel 
the current location service attempt and the associated signaling dialogue with RAN, if still existing, by sending a "stop 
reporting" message to RAN. The "stop reporting" message shall contain the reason for the location procedure 
cancellation in A/Gb mode or the indication about the type of location request to cancel (e.g. direct) in lu mode. The 
VMSC /MSC server shall then return an error response to the client or network entity from which the location request 
was originally received. The VMSC /MSC server shall also release all resources specifically allocated for the location 
attempt. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the VMSC /MSC server need take no action. 

Table 9.1 : LCS Error Recovery Procedures in the VMSC /MSC server for certain Events 



Event 


VMSC /MSC server Error Recovery 


Release of radio channel to the UE 


Abort 


Any error response from RAN except for SRNC relocation or inter- 
MSC handover 


Abort 


In lu mode inter RNC hard handover, SRNC relocation and inter- 
MSC or MSC server handover 


Abort on lu level 

Restart after process is completed 


In A/Gb mode inter-IVISC Handover and inter-BSC handover 


Restart after handover is completed 


InterSystem handover 


Restart after handover is completed 



If RAN is in an overload condition, it may reject a location request by indicating congestion. The VMSC /MSC server 
may reduce the frequency of future location service requests until rejection due to overload has ceased. 

9.4.2 Void 

9.4.3 Procedures in tine SGSN 

After the SGSN has requested a location service for a particular UE from RAN, certain events may occur that may 
temporarily or permanently interfere with the location service attempt. For each such event notified to the SGSN, the 
SGSN shall employ one of the following error recovery actions. 

Restart the Location Service 

This action shall be employed for any event that temporarily impedes a location service attempt and cannot be delayed 
until the location service attempt is complete. When such an event is notified to the SGSN, it shall immediately cancel 
the location service attempt and the associated signaling dialogue with RAN, if this still exists by sending a "stop 
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reporting" (lu mode) or "location abort" (A/Gb mode) message to RAN. The "stop reporting"/"location abort" message 
shall contain the reason for the location procedure cancellation. 

After aborting the location request dialogue with RAN, the SGSN may queue the location service request until the event 
causing the restart has terminated (if not already terminated). The SGSN may optionally wait for an additional time 
period (e.g. if the queuing delay is minimal) to ensure that any resources allocated in and by RAN have time to be 
released. The SGSN may then send another location service request to RAN associated with the target UE. 

Abort the Location Service 

This action shall be employed for any event that permanently impedes a location service attempt, such as loss of the 
radio channel to the target UE. When such an event is notified to the SGSN, it shall cancel the current location service 
attempt and the associated signaling dialogue with RAN, if still existing, by sending a "stop reporting"/"location abort" 
message to RAN. The "stop reporting"/"location abort" message shall contain the reason for the location procedure 
cancellation. The SGSN shall then return an error response to the client or network entity from which the location 
request was originally received. The SGSN shall also release all resources specifically allocated for the location 
attempt. 

The following table indicates the appropriate error recovery procedure for certain events. For events not listed in the 
table, the SGSN need take no action. 

Table 9.2: LCS Error Recovery Procedures in the SGSN for certain Events 



Event 


SGSN Error Recovery 


Release of radio channel to the UE 


Abort 


Any error response from RAN causing unavailable signalling 
connections 


Abort 


Inter RNC hard handover, Inter SRNC relocation (lu mode 
only) 


Abort on lu level 

Restart after process is completed 


Suspend of GPRS services (A/Gb mode only)(During OS 
connection for class B UE) 


Abort 


Intra SGSN Routing Area Update (A/Gb mode only) 


Restart 


Inter SGSN Routing Area Update, inter SGSN relocation 


Abort (Note: GMLG may restart) 


Standalone P-TMSI Reallocation (A/Gb mode only) 


Restart 



9.4.4 Void 



9.4.5 Handover handling 



9.4.5.1 



VMSC /MSC server procedure for Inter-VMSC /MSC server Handover 



When a location estimate is required for a target UE with an established call in a state of inter- VMSC /MSC server 
handover, the serving location area ID shall be used by the visited MSC /MSC server to identify the correct RAN to 
serve the location request. All location request related messages shall be sent via MAP/E interface piggy-backed in 
MAP_FORWARD_ACCESS_SIGNALLING and MAP PROCESS_ACCESS_SIGNALLING between the visited and 
serving MSCs /MSC servers. 



9.4.5.2 



Handling of an ongoing handover while a request for positioning arrives 



If during an ongoing handover procedure a request for location information arrives, the request shall be suspended until 
the handover is completed. On completion of the handover, the location preparation procedure shall continue. 



9.4.5.3 



Handover handling in lu mode 



In case of hard handovers in lu mode, e.g. inter RNC hard handover, or Serving RNC relocation, and inter- MSC, MSC 
Server or SGSN handovers, the ongoing positioning process is aborted on lu level. In soft handovers where the Serving 
RNS and lu are relocated, any ongoing positioning process is also aborted on lu level. The MSC, MSC Server or SGSN 
shall restart the lu aborted location requests with the new Serving RNC. The new SGSN, however, shall not restart the 
location request after inter SGSN Routing Area Update or inter SGSN relocation. During intra and inter RNC soft and 
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softer handovers the existing RRC connection can normally be used without any need to abort the on-going positioning 
process on lu level. 

9.5 Privacy 

9.5.1 Privacy Override Indicator (POI) 

The POI is used to determine whether the privacy settings of the subscriber to be positioned shall be overridden by the 
request for location services. The POI is applicable only to Emergency service and Lawful intercept service. The 
assignment of a POI value with an "override" or "not override" value in the LCS client profile is done during the LCS 
client provisioning. The type of LCS client requesting location information (i.e. emergency, law-enforcement etc.) shall 
determine the value of the POI assigned to the LCS client profile. 

There are two distinct cases regarding the handling of the privacy override indicator. 

Procedure A: If the subscriber to be positioned is in the same country as the GMLC or if the subscriber to be positioned 
is in a different country than the GMLC and an appropriate bilateral agreement exists between operators, then the POI 
shall override the subscriber's privacy options, as allowed by regulatory requirements. 

Procedure B: Otherwise the POI shall not override the subscriber's privacy options. 

9.5.2 Privacy Procedures 

The privacy profile of the UE subscriber (SLPP) may be stored in HLR/HSS and/or in H-GMLC/PPR. If the privacy 
profile data are stored in SLPP of H-GMLC/PPR, then the pseudo external identities, if required, shall be contained in 
the SLPP of the HLR/HSS. Also if the privacy profile data are stored in H-GMLC/PPR, H-GMLC/PPR sends the 
indicators of privacy related action or the pseudo external identities to the serving nodes in order to inform the results of 
the privacy check procedures in H-GMLC/PPR. 

The SLPP stored in the HLR/HSS shall be downloaded to the VMSC, MSC Server and SGSN together with the rest of 
his subscription information in the existing operation INSERT_SUBSCRIBER_DATA. It will be deleted with the 
existing operation DELETE_SUBSCRIBER_DATA. 

In case of an Emergency Services location request, based on the location of the VMSC/MSC Server/SGSN and the R- 
GMLC, the V -GMLC evaluates whether to accept or ignore the received POI, according to the definition in clause 
9.1.5. If privacy override is not allowed, then the V-GMLC rejects the request. 

In case the privacy override i s allowed, the POI is transferred from the GMLC to the VMSC/MSC Server/SGSN in the 
location request. Based on the location of the GMLC the VMSC/MSC Server/SGSN evaluates whether to accept or 
ignore the received POI according to the definition in clause 9.5.1. 

If the POI is accepted the location requested is unconditionally performed. Otherwise the VMSC/MSC Server/SGSN 
evaluates the privacy options in the UE subscriber's subscription profile (assuming this is held in the VLR/MSC 
Server/SGSN) or evaluates the received privacy related action indicators. If the corresponding register does not contain 
the UE subscription profile, LCS will rely on the existing GSM recovery mechanisms to obtain the profile. 

If local regulatory requirements mandate it, any MT-LR for an emergency services LCS client and any NI-LR for an 
emergency services call origination shall be allowed by the VMSC/MSC Server. 

If the location request is allowed by the privacy options the location request is performed. Otherwise, if the location 
request is barred by the privacy options, the location request is refused an error response is returned to the LCS client 
with a cause code indicating that the request was rejected by the subscriber. 
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9.5.3 UE Privacy Options 



The UE privacy options in the SLPP apply to an CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR and either indicate that no 
CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR is allowed for the UE (except as may be overridden by the POI or local 
regulatory requirements) or define the particular classes of LCS client for which an CS-MT-LR/PS-MT-LR or 
NI-LR/PS-NI-LR for location are allowed, with the following classes being possible: 

[Editor's note: An e-mail comment pointed out that there are different cases still to be covered in the description of 
the classes: 1. the LCS Client identity is included in SLPP or 2. the LCS Client identity is NOT included 
in SLPP. Also some GMLC restriction conditions need to be mentioned.] 

a) Universal Class - allow positioning by all LCS clients; 

b) Call/Session related Class 

c) Call/Session-unrelated Class 

d) PLMN operator Class 

Moreover the SLPP may contain the service types allowed by the subscriber. 

All UE privacy options of above four classes are commonly used for both CS and PS domain. 

The privacy classes are selected according to the rules described in the ANNEX A. If more than one privacy class are 

subscribed in the UE"s SLPP, the looser privacy setting shall be selected. ANNEX A applies also in case service types 

privacy checking are subscribed together with one or more other privacy classes. 

Note 1 : If a privacy option setting in a domain is updated, the same modification will be applied to the other 
domain. 

Note 2: The options for each privacy class and the service type are described in the subsequent chapters 

independently from the options of the other privacy classes. The combination of the privacy class and 
service type options are described in the rules of Annex A 

9.5.3.1 Universal class 

When the user of the UE subscribes to the "Universal Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR 
positioning is allowed by all LCS clients. 

If the UE subscribes to the universal class, any CS-MT-LR or NI-LR shall be allowed by the VMSC/MSC Server and 
any PS-MT-LR or PS-NI-LR shall be allowed by the SGSN. 

If the UE subscribes to the universal class and H-GMLC/PPR knows that the serving node supports the indicator of 
privacy check related action, H-GMLC/PPR sends the indicators for call/session unrelated class, which indicates 
'Location allowed without notification'. If the UE subscribes to the universal class and H-GMLC/PPR knows that the 
serving node does not support the indicator of privacy check related action, H-GMLC/PPR may sends the appropriate 
pseudo external identity as described in Annex C. 

9.5.3.2 Call/Session related class 

When the user of the UE subscribes to the "Call/Session related Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR 
positioning is allowed in the following cases: 

Allow positioning by specific identified value added LCS client or groups of value added LCS Chent to which the UE 
originated a call in CS domain or a value added LCS client with which the UE has a session via an active PDP context 
in PS domain indicated by a specific APN-NI. For each identified LCS client or group of LCS Clients, one of the 
following subscription options shall apply: 

* location request allowed only from GMLCs identified in the SLPP; 

* location request allowed only from a GMLC in the home country; 

* location request allowed from any GMLC (default case). 

For each identified value added LCS client or group of LCS Clients in the privacy exception list, one of the 
following subscription options shall apply: 
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* positioning allowed without notifying the UE user (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

For all value added LCS clients sending a call related CS-MT-LR/PS-MT-LR that are not identified in the 
privacy exception list, one of the following subscription option shall apply: 

* positioning not allowed; 

* positioning allowed without notifying the UE user (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

NOTE 2: The usage of Call/Session related Class in the IM subsystem is FFS. 

9.5.3.2.1 Call/session-related class in the CS-domain 

If the UE subscribes to the call/session-related class, an CS-MT-LR maybe allowed if both of following conditions are 

met: 

The UE previously originated a call in CS domain that is still established and the called party number dialled by 
the UE matches the called party number received from the GMLC. 

The identity of the LCS client or LCS client group supplied by the GMLC matches the identity of any LCS 
Client or LCS Client group contained in the UE"s SLPP and any other GMLC restrictions associated with this 
LCS Client identity in the SLPP are also met 

If these conditions are satisfied, the CS-MT-LR shall be allowed if the UE user subscribes to either location without 
notification or location with notification. If the UE user subscribes to location with notification and privacy verification, 
the CS-MT-LR shall be allowed following notification to the UE if the UE user either returns a response indicating that 
location is allowed or returns no response but subscribes to allowing location in the absence of a response. In all other 
cases, the CS-MT-LR shall be restricted. 

9.5.3.2.2 Call/session-related class in the PS-domain 

If the UE subscribes to the call/session-related class, a PS-MT-LR may be allowed if all of the following conditions are 

met: 

The UE previously originated a PDP-context towards the network where the external client is located and that 
this context is still established. 

- The APN-NI negotiated between the UE and SGSN matches the APN-NI received from the GMLC. 

The identity of the LCS client or LCS client group supplied by the GMLC matches the identity of any LCS 
Client or LCS Client group contained in the UE"s SLPP and any other GMLC restrictions associated with this 
LCS Client identity in the SLPP are also met. 

If these conditions are satisfied, the PS-MT-LR shall be allowed if the UE user subscribes to either location without 
notification or location with notification. If the UE user subscribes to location with notification and privacy verification, 
the PS-MT-LR shall be allowed following notification to the UE if the UE user either returns a response indicating that 
location is allowed or returns no response but subscribes to allowing location in the absence of a response. In all other 
cases, the PS-MT-LR shall be restricted. 
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9.5.3.2.3 Call/session-related class when LCS client not in SLPP 

If the UE subscribes to the call/session related class, a CS-MT-LR or PS-MT-LR from an LCS client that is NOT 
contained in the SLPP of the target UE shall be allowed or restricted according to the following conditions: 

For any non-matched LCS client, the CS-MT-LR or PS-MT-LR shall be allowed, if the UE user subscribes to 
either location without notification or location with notification. 

If the UE user subscribes to location with notification and privacy verification, the CS-MT-LR or PS-MT-LR shall be 
allowed following notification to the UE if the UE user either returns a response indicating that location is allowed or 
returns no response but subscribes to location in the absence of a response. In all other cases, the CS-MT-LR or PS-MT- 
LR shall be restricted. 

9.5.3.3 Call/Session-unrelated class 

When the user of the UE subscribes to the "Call/Session unrelated Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI- 
LR positioning is allowed in the following cases: 

Allow positioning by specific identified value added LCS Clients or groups of value added LCS Client with the 
following restrictions allowed for each identified value added LCS Client or group of value added LCS Clients: 

* location request allowed only from GMLCs identified in the SLPP; 

* location request allowed only from a GMLC in the home country; 

* location request allowed from any GMLC (default case). 

For each identified value added LCS client in the privacy exception list, one of the following subscription 
options shall apply: 

* positioning allowed without notifying the UE user (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

For all value added LCS clients sending a non-call related CS-MT-LR/PS-MT-LR that are not identified in the 
privacy exception list, one of the following subscription option shall apply: 

* positioning not allowed (default case); 

* positioning allowed with notification to the UE user; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user or if there is no response to the notification; 

* positioning requires notification and verification by the UE user; positioning is allowed only if granted by the 
UE user. 

9.5.3.3.1 Call/session-unrelated class when LCS client identities match 

If the UE subscribes to the call/session-unrelated class, an CS-MT-LR/PS-MT-LR maybe allowed by the MSC/MSC 
server or SGSN if the identity of the LCS client or LCS client group supplied by the GMLC matches the identity of any 
LCS Client or LCS Client group contained in the UE's SLPP and any other GMLC restrictions associated with this LCS 
Client identity in the SLPP are also met. 

If the LCS client is correctly matched in this way and any GMLC restrictions are satisfied, the CS-MT-LR/PS-MT-LR 
shall be allowed if the UE user subscribes to either location without notification or location with notification. If the UE 
user subscribes to location with notification and privacy verification, the CS-MT-LR/PS-MT-LR shall be allowed 
following notification to the UE if the UE user either returns a response indicating that location is allowed or returns no 



£75/ 



3GPP TS 23.271 version 6.1 0.0 Release 6 89 ETSI TS 1 23 271 V6.1 0.0 (2004-1 2) 

response but subscribes to location in the absence of a response. In all other cases, the CS-MT-LR/PS-MT-LR shall be 
restricted. 

9.5.3.3.2 Call/session-unrelated class when LCS client identities do not match 

If the UE subscribes to the call/session-unrelated class, an CS-MT-LR/PS-MT-LR from an LCS client that is not 
contained in the UE's SLFF shall be allowed or restricted according to the following conditions. For any non-matched 
LCS client, the CS-MT-LR/PS-MT-LR shall be allowed if the UE user subscribes to location with notification. If the 
UE user subscribes to location with notification and privacy verification, the CS-MT-LR/PS-MT-LR shall be allowed 
following notification to the UE if the UE user either returns a response indicating that location is allowed or returns no 
response but subscribes to location in the absence of a response. In all other cases, the CS-MT-LR/PS-MT-LR shall be 
restricted. 

9.5.3.4 PLMN operator class 

When the user of the UE subscribes to the " PLMN operator Class" the CS-MT-LR/PS-MT-LR or NI-LR/PS-NI-LR 
positioning is allowed in the following cases: 

Allow positioning by specific types of client within or associated with the VPLMN, with the following types of client 
identified: 



* 



* 



* 



* 



clients providing a location related broadcast service; 

O&M client in the HPLMN (when the UE is currently being served by the HPLMN); 

O&M client in the VPLMN; 

clients recording anonymous location information without any UE identifier; 

clients enhancing or supporting any supplementary service, IN service, bearer service or teleservice subscribed 
to by the target UE subscriber. 



If the UE subscribes to the PLMN class, an NI-LR/PS-NI-LR or CS-MT-LR/PS-MT-LR shall be allowed if the cHent 
within the VPLMN, for an NI-LR/PS-NI-LR, or the client identified by the GMLC, for an CS-MT-LR/PS-MT-LR, 
either matches a generic type of client contained in the UE's SLPP or is otherwise authorized by local regulatory 
requirements to locate the UE. If H-GMLC/PPR knows that the serving node supports LCS capability set 4, then H- 
GMLC/PPR will send the indicators for call/session unrelated class, which indicates "location allowed without 
notification". If H-GMLC/PPR is notified that the serving node does not support the LCS capability set 4, then it will 
not send any indicator. 

9.5.3.5 Service type checking 

If the SLPP contains service types, a CS-MT-LR/PS-MT-LR may be allowed if the service type supplied by the LCS 
client matches the identity of any service type contained in the UE's SLPP and any other GMLC restrictions associated 
with this service type in the SLPP are also met. 

If the service type is correctly matched in this way and any GMLC restrictions are satisfied, the CS-MT-LR/PS-MT-LR 
shall be allowed if the UE user subscribes to either location without notification or location with notification. If the UE 
user subscribes to location with notification and privacy verification, the CS-MT-LR/PS-MT-LR shall be allowed 
following notification to the UE if the UE user either returns a response indicating that location is allowed or returns no 
response but subscribes to location in the absence of a response. In all other cases, the CS-MT-LR/PS-MT-LR shall be 
restricted. 

9.5.3.6 Matching of LCS client identities 

In evaluating privacy where any address "A" associated with the LCS client (e.g. LCS client ID or GMLC address) 
needs to be compared with a corresponding address "B" in the target UE's SLPP, a match shall be determined if a match 
is found for each of the following components of each address: 

a) numbering plan; 

b) nature of address indicator; 
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c) corresponding address digits for all digits in "B" (the digits or initial digits in "A" must match all the digits in 
"B", but "A" may contain additional digits beyond those in "B"). 

All addresses shall be transferred to the MSC/VLR, MSC server or SGSN in international format, except for the called 
party number received from the GMLC during a Call-Related CS MT-LR when the LCS client was reached via IN or 
abbreviated number routing (e.g. toll-free number or emergency call routing). In these cases it is up to the GMLC to use 
the valid national specific number of the visited country. 

In evaluating privacy where an APN-NI associated with the LCS client notified by the GMLC needs to be compared 
with a corresponding APN-NI that is used to set up the associated PDF context, a match shall be determined if a match 
is found for each component of APN-NI. 

9.5.4 Indicator of privacy cineck related action 

When the client type indicates value added service and the serving node supports LCS capability set 4, H-GMLC/PPR 
shall select indicators for privacy check related action and the indicators shall be included in the 

Provide_Subscriber_Location request towards the serving node. The indication is sent to the serving node directly from 
the H-GMLC or via V-GMLC. There shall be an indicator for the call/session unrelated. Another indicator for the 
call/session related is optional and it shall be sent only if call/session related identity, i.e. the number dialled by UE or 
APN-NI, is sent to the serving node. 

The possible values of the indicator of privacy check related action for call/session unrelated case shall be: 

Location allowed without notification 

Location allowed with notification 

Location with notification and privacy verification; location allowed if no response 

Location with notification and privacy verification; location restricted if no response 

Location not allowed (only applicable when the indicator for call/session related case is sent, or the POI is 
included in the provide subscriber location request) 

The possible values of the indicator of privacy check related action for call/session related case shall be: 

Location allowed without notification 

Location allowed with notification 

Location with notification and privacy verification; location allowed if no response 

Location with notification and privacy verification; location restricted if no response 

If both indicators are sent but indicating different actions and the call/session related criteria met in the serving node 
then an action according to the indicator with the looser action according to the definition in Annex A shall be chosen as 
shown in Annex A. 3. 

If the UE subscribes service types, then the result of the service type checking may be included in any of the privacy 
check indicators, as it is described in annex A. 3. 

If the UE subscribes either to PLMN class or to the universal class, H-GMLC/PPR sends the indicator for call/session 
unrelated class with the value of 'Location allowed without notification'. 
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9.6 Mobile Originating Location 

An UE may subscribe to any of the following classes of mobile originating location: 

a) Basic Self Location; 

b) Autonomous Self Location; 

c) Transfer to Third Party. 

An MO-LR shall be allowed by the VMSC if the type of request is supported by the appropriate subscription according 
to the following table. 

Table 9.3: Required UE Subscription Options for IVIO-LR Requests 



Type of MO-LR Request 


Required UE Subscription 


UE requests own location 


Basic Self Location 


UE requests location assistance data 


Autonomous Self Location 


UE requests transfer of own location to another LCS Client 


Transfer to Third Party 



9.7 CIV! Procedures 

9.7.1 Location request for a mobile in idle-mode 

When a request for location information is received at the VMSC the LCS-layer shall order paging of the UE 
subscriber. In case of first unsuccessful paging, normal paging procedures should apply. After successful paging the 
LCS-layer shall invoke the location preparation procedure. 

9.7.2 Location request for a mobile in dedicated-mode 

When a request for location information is received at the VMSC, if the UE is already busy on CM level, the LCS-layer 
shall attempt to establish a parallel transaction to the existing one. If successful, the LCS-layer shall invoke the location 
preparation procedure. 

9.8 Interworking with the IMS 

9.8.1 Standard Location Request using a SIP-URI 

An external LCS Client shall use the same interface to the LCS Server regardless of the target UE"s identity. 

If a location request from an external LCS client uses a SIP-URI as the target UE"s identity, the requesting GMLC shall 
invoke a LIMS-IWF (Location IMS Interworking Function) to route the request to the user"s home network. This 
routing mechanism may use standard technologies like pre-configuration of destination addresses or DNS lookups to 
determine the address of a LIMS-IWF in the home network of the user. The interface between two LIMS-IWF in 
different networks shall be Lr. 

If the LIMS-IWF in the home network is not co-located with the home GMLC, it shall use the same interface towards 
the home GMLC as the requesting GMLC, i.e. the Lr interface. The LIMS-IWF in the home network has to determine 
the HSS serving the user. This may be done e.g. by a Dh SLF query or the HSS address is known to the LIMS-IWF 
through configuration. The LIMS-IWF retrieves the MSISDN from the HSS through Sh Pull and use MAP Send 
Routing Info for LCS to get the home GMLC IP address from the HLR. Afterwards the LIMS-IWF in the home 
network can forward the LCS service request (including the target UE"s MSISDN) on the Lr interface to the home 
GMLC. 

The following figure shows the principle call flow when a GMLC receives a location request where the target UE"s 
identity is an IMS Public User Identity (SIP-URI). 
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Figure 9.9: MT-LR procedure for IMS Public User Identities 

1 . An external LCS Client requests the current location of a target UE from a R-GMLC using the Public User 
Identity (SIP-URI) associated with the target UE. 

2. The R-GMLC selects a LIMS-IWF in the requesting network. The LIMS-IWF address may be pre-configured or 
DNS is used for this purpose. The R-GMLC forwards the LCS service request to the requested LIMS-IWF via Lr 
interface. 

3. The LIMS-IWF in the requesting network determines the LISM-IWF address in the home network. This may be 
done by using a pre-configured address or by DNS. The requesting LIMS-IWF forwards the LCS service request 
to the home LIMS-IWF via Lr interface. 

4. The home LIMS-IWF queries the SLF via Dh interface to get the HSS address (using the Dh interface to retrieve 
the HSS address is an option). 

5. The home LIMS-IWF retrieves the HSS address from the SLF via Dh SLF Response. 

6. The home LIMS-IWF queries the HSS via Sh PULL (including the SIP-URI) to get the user"s MSISDN. 



£75/ 



3GPP TS 23.271 version 6.1 0.0 Release 6 93 ETSI TS 1 23 271 V6.1 0.0 (2004-1 2) 

7. The home LIMS-IWF retrieves the user"s MSISDN from the HSS via Sh PULL Response. 

8. The LIMS-IWF uses MAP Send Routing Info for LCS to get the H-GMLC address from the HLR. 

9. The LIMS-IWF retrieves the H-GMLC address from the HLR. 

10. The LCS service request is forwarded to the H-GMLC through Lr interface. 

1 1 . The H-GMLC performs the privacy check. 

12. The H-GMLC queries the HLR using MAP Send Routing Info for LCS to get the V-GMLC address. 

13. The H-GMLC retrieves the V-GMLC address from the HLR. 

14. The H-GMLC forwards the LCS service request to the V-GMLC. 

15. The standard MT-LR procedure is performed. 

16. The LCS service response is send from the V-GMLC to the H-GMLC. 

17. The H-GMLC performs the privacy check. 

18. The LCS service response is send from the H-GMLC to home LIMS-IWF. 

19. The LCS service response is send from the home LIMS-IWF to the requesting LIMS-IWF. 

20. The LCS service response is send from the requesting LIMS-IWF to the R-GMLC. 

21. The LCS service response is send from the R-GMLC to the external LCS Client. 

9.8.2 Standard Location Request using a TEL-URL 

IF a location request from an external LCS client uses a TEL-URL as the target UE"s identity, the requesting GMLC 
shall convert the TEL-URL into a MSISDN, use this MSISDN in the location request as the target UE"s address and 
continue with the MT-LR procedure for the PS domain. 

9.8.3 Mobile Originated Location Requests in tine IMS 

Mobile Originated Location Requests will not specifically require IMS interworking and therefore are not covered 
within this specification. 



1 Information storage 



This clause describes information storage structures that are mandatory (M), conditional (C) or optional (O) for LCS, 
and the recovery and restoration procedures needed to maintain service if inconsistencies in databases occur and for lost 
or invalid database information. Information storage in RAN network elements is specified in UTRAN Stage 2 
(TS 25.305 [1]) and GERAN Stage 2 (TS 43.059 [16]) specifications. 

10.1 HLR and HSS 

The HLR/HSS holds LCS data for both UE subscribers and LMUs. If the privacy profile data for UE subscribers are 
stored in H-GMLC/PPR, HLR/HSS needs to store the corresponding pseudo-external identities and MO-LR related 
subscription data shown in Table 10.4 and 10.5. The pseudo-external identities are stored in the privacy exception list 
shown in Table 10.2. The details of the pseudo-external identity are described in Annex C. 

1 0.1 .1 LCS Data in the HLR/HSS for an UE Subscriber 

The IMSI is the primary key for LCS UE subscription data in the HLR/HSS. This subscription data may be stored in a 
Multiple Subscriber Profile (MSP), with the HLR/HSS able to hold a number of MSPs per IMSI. 
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LCS UE subscription data includes a privacy exception list containing the privacy classes for which location of the 
target UE is permitted. Each privacy class is treated as a distinct supplementary service with its own supplementary 
service code. The following logical states are applicable to each privacy class (refer to TS 23.011 [22] for an 
explanation of the notation). 

Table 10.1 : Logical States for each LCS Privacy Class 



Provisioning State 


Registration State 


Activation State 


HLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS privacy class, the HLR/HSS shall store the logical state of the class on a per-subscriber (or per subscriber 
MSP) basis. In addition, the permanent data indicated below shall be stored on a per subscriber (or per subscriber MSP) 
basis when the logical provisioning state of the associated LCS privacy class is "provisioned". For the meaning of each 
LCS privacy class, refer to clause 9 and to TS 22.071 [4]. 
Moreover a list of allowed service types may be stored. The meaning of service types is defined in TS 22.071 [4]. 
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Table 10.2: LCS data stored in the HLR privacy exception list for an UE Subscriber 

(or UE Subscriber IVISP) 



LCS Privacy Class 


Status 


Additional HLR Data when Class is provisioned 


Universal Class 


- 


No additional data 


Call/session Related Class 


M 


C 



c 


Indication of one of the following mutually exclusive options for any LCS 
client not in the external LCS client list: 

• Location not allowed 

• Location allowed without notification (default case) 

• Location allowed with notification 

• Location with notification and privacy verification; location 
allowed if no response 

• Location with notification and privacy verification; location 
restricted if no response 

External LCS client list: a list of zero or more LCS clients, with the 
following data stored for each LCS client in the list: 

• International E.1 64 address identifying a single LCS client or a 
single group of LCS clients that are permitted to locate this 
target UE 

• Restriction on the GIVILC. If no value is stored for this data, 
there is no restriction on GIVILC and any GMLC is allowed to 
request location information for the UE. Possible values are: 

Identified GIVILCs only 

Any GIVILC in the home country 

• Indication of one of the following mutually exclusive options: 

Location allowed without notification (default case) 

Location allowed with notification 

Location with notification and privacy verification; location 

allowed if no response 

Location with notification and privacy verification; location 

restricted if no response 


Call/session Unrelated Class 


M 


c 



c 


Indication of one of the following mutually exclusive options for any LCS 
client not in the external LCS client list: 

• Location not allowed (default case) 

• Location allowed with notification 

• Location with notification and privacy verification; location 
allowed if no response 

• Location with notification and privacy verification; location 
restricted if no response 

External LCS client list: a list of zero or more LCS clients, with the 
following data stored for each LCS client in the list: 

• International E.1 64 address identifying a single LCS client or a 
single group of LCS clients that are permitted to locate this 
target UE 

• Restriction on the GIVILC. If no value is stored for this data, 
there is no restriction on GMLC and any GIVILC is allowed to 
request location information for the UE. Possible values are: 

Identified GMLCs only 

Any GMLC in the home country 

• Indication of one of the following mutually exclusive options: 

Location allowed without notification (default case) 

Location allowed with notification 

Location with notification and privacy verification; location 

allowed if no response 

Location with notification and privacy verification; location 

restricted if no response 


PLMN Operator Class 





LCS client list: a list of one or more generic classes of LCS client that 
are allowed to locate the particular UE. The following classes are 
distinguished: 

• LCS client broadcasting location related Information 

• O&M LCS client in the HPLMN 

• O&M LCS client in the VPLMN 
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LCS client recording anonymous location information 
LCS Client supporting a bearer service, teleservice or 
supplementary service to the target UE 



Table 10.3: LCS Service types stored in the HLR/HSS per UE subscriber 



Service type indication 


Status 


Additional HLR data when the indication is stored 


Service Types 





Service types list: a list of one or more service types for which the LCS 
client is allowed to locate the particular UE. The possible service types 
are defined in 22.071 [4]. The following data may be present for each 
service type in the list: 







- Restriction on the GMLC. If no value is stored for this data, 
there is no restriction on GMLC and any GMLC is allowed to 
request location information for the UE. Possible values are: 




c 


- Identified GMLCs only 

- Any GMLC in the home country 

- Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location 
allowed if no response 

- Location with notification and privacy verification; location 
restricted if no response 



In case that UE"s privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, pseudo-external 
identities may be set in the external LCS client list of the HLR privacy exception list shown in Table 10.2. The pseudo- 
external identity is not the identity of real external LCS client but the identity which is used for notifying SGSN/MSC 
of the location request class (call/session related or non-call/session related) and the required type of indication for each 
class. Operator allocates E.164 addresses for the pseudo-external identities. 

Fourteen pseudo-external identities are needed to be defined. The pseudo-external identities are summarized in the 
Table C.l. The pseudo-external identities are registered in SLPP of each UE in advance. 

LCS UE subscription data may include a mobile originating list containing the LCS mobile originating classes that an 
UE is permitted to request. Each LCS mobile originating class is treated as a distinct supplementary service with its 
own supplementary service code. The following logical states are applicable to each mobile originating class (refer to 
TS 23.011 [22] for an explanation of the notation). 

Table 10.4: Logical States for each Mobile Originating LCS Class 



Provisioning State 


Registration State 


Activation State 


HLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS Mobile Originating class, the HLR/HSS shall store the logical state of the class on a per-subscriber (or 
per subscriber MSP) basis. In this version of LCS, there is no additional permanent data in the HLR. The table below 
shows the defined mobile originating classes. For the meaning of each LCS mobile originating class, refer to clause 8 
and to TS 22.071 [4]. 
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Table 10.5: Data stored in the HLR for the LCS Mobile Originating List for an UE 

(or UE Subscriber IVISP) 



LCS Mobile Originating 
Class 


Status 


Additional HLR Data when Class is provisioned 


Basic Self Location 


- 


No additional data 


Autonomous Self Location 


- 


No additional data 


Transfer to Third Party 


- 


No additional data 



In addition to the privacy exception list, the following other data items may be stored in the UE subscription profile in 
the HLR to support LCS. 

Table 10.6a: Temporary LCS data in the HLR 



Other Data in the HLR 


Status 


Description 


GMLC List 





List of one or more E.I 64 addresses of the GMLCs from which a 
location request for an MT-LR is allowed, The addresses are only 
relevant to an LCS client that is restricted (in the UE privacy exception 
list) to making call/session related or call/session unrelated location 
requests. 



10.2 VLR/SGSN 

The VLR/SGSN contains the same LCS permanent data for each registered UE subscriber, as does the HLR/HSS. This 
data is downloaded to the VLR/SGSN as part of the location update procedure between the VLR/SGSN and HLR/HSS 
for an UE subscriber. 

10.3 GMLC 

1 0.3.1 LCS Data in the GMLC for a LCS Client 

The GMLC holds data for a set of external LCS clients that may make call related or non-call related 
CS-MT-LR/PS-MT-LR requests to this GMLC. The permanent data administered for each LCS client is as follows. 



£75/ 



3GPP TS 23.271 version 6.10.0 Release 6 



98 



ETSI TS 123 271 V6.10.0 (2004-12) 



Table 10.7: GMLC Permanent Data for a LCS Client 



LCS Client data in GMLC 


Status 


Description 


LCS Client Type 


M 


Identifies the type LCS client from among the following: 

- Emergency Services 

- Value Added Services 

- PLMN Operator Services 

- Lawful Intercept Services 


External identity 





A list of one or more identifiers used to identify an external LCS client. 
The identity may be used when making an IVIT-LR and/or MO-LR. The 
format of the identity is an international E.164 address [35a]. Each 
external identity shall be associated with a logical client name. 


Authentication data 


M 


Data employed to authenticate the identity of an LCS client - details are 
outside the scope of the present document 


Call/session related identity 





A list of one or more international E.164 addresses [35a], which are used 
to make calls by mobile subscribers, or APN-NIs (see NOTE) to identify 
the client for a call related IVIT-LR 

In case the LCS client was reached via IN or abbreviated number routing 
(e.g. toll free number or emergency call routing), the E.1 64 number(s) 
stored in the GMLC shall be the number(s) that the UE has to dial to 
reach the LCS Client. In these cases the E.1 64 number is not to be in 
international format. The country in which the national specific number(s) 
is (are) applicable is (are) also stored (or implied) in this case. 
Each call related identity may be associated with a specific external 
identity. Each call/session-related identity shall be associated with a 
logical client name. 


Internal identity 





Identifies the type PLIVIN operator services and the following classes are 
distinguished: 

- LCS client broadcasting location related information 

- O&M LCS client in the HPLMN 

- O&M LCS client in the VPLMN 

- LCS client recording anonymous location information 

- LCS Client supporting a bearer service, teleservice or 
supplementary service to the target UE 

This identity is applicable only to PLIVIN Operator Services. 


Client name 





An address string which is associated with LCS client's external identity 
(i.e., E.164 address). See note 2. 


Client name type 





Indication what is the type of the LCS client name. The type of the LCS 
client name can be one of the following: 

- Logical name 

- MSISDN 

- E-mail address[33] 

- URL[33] 

- SIP URL[34] 

- IMS public identity[35] 


Override capability 





Indication of whether the LCS client possesses the override capability 
(not applicable to a value added and PLIVIN operator service) 


Authorized UE List 





A list of IVISISDNs or groups of MSISDN for which the LCS client may 
issue a non-call related MT-LR. Separate lists of MSISDNs and groups of 
MSISDN may be associated with each distinct external or non-call related 
client identity. 
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Priority 


M 


The priority of the LCS client - to be treated as either the default priority 
when priority is not negotiated between the LCS server and client or the 
highest allowed priority when priority is negotiated 


QoS parameters 


M 


The default QoS requirements for the LCS client, comprising: 

- Accuracy 

- Response time 

- LCS QoS Class 

Separate default QoS parameters may be maintained for each distinct 
LCS client identity (external, non-call related, call related) 


Service Coverage 





A list of E.1 64 country codes for geographic areas [35a] where the LCS 
client offers its location services. 


Allowed LCS Request Types 


M 


Indicates which of the following are allowed: 

- Non-call related CS-MT-LR/PS-MT-LR 

- Call/session related CS-MT-LR/PS-MT-LR 

- Specification or negotiation of priority 

- Specification or negotiation of QoS parameters 

- Specification or negotiation of Service Coverage parameter 

- Request of current location 

- Request of current or last known location 


Local Co-ordinate System 





Definition of the co-ordinate system(s) in which a location estimate shall 
be provided - details are outside the scope of the present document 


Access Barring List(s) 





List(s) of MSISDNs or groups of MSISDN for which a location request is 
barred 


Service Identities 





List of service identities allowed for the LCS client. 


Maximum Target UE Number 





The maximum number of the Target UEs in one LCS request. For a 
specific LCS Client, this parameter may have different values for different 
service identities. 



NOTE 1: The LCS Client is identified with E.164 number or APN-NI. APN-NI is specified in TS 23.003 [17]. 

NOTE 2: The LCS Client name should not contain two equal signs, because those characters are used to separate 
LCS client name from Requestor ID when GMLC includes them into the same field. 

1 0.3.2 LCS Data in the GMLC/PPR for a UE Subscriber 

The GMLC (H-GMLC) or PPR may store LCS UE subscription data. This chapter describes Rel-5 based privacy profile 
data stored in GMLC/PPR. If the home network operator uses Rel-5 compatible privacy profile data, the profiles shown 
in this chapter may be stored in GMLC/PPR. 

The IMSI or MSISDN is the primary key for LCS UE subscription data in the GMLC/PPR. This subscription data may 
be stored in a Multiple Subscriber Profile (MSP), with the GMLC/PPR able to hold a number of MSPs per IMSI. 

LCS UE subscription data includes a privacy exception list containing the privacy classes for which location of the 
target UE is permitted. Each privacy class is treated as a distinct supplementary service with its own supplementary 
service code. The following logical states are applicable to each privacy class (refer to TS 23.011 [22] for an 
explanation of the notation). 

Table 10.9: Logical States for each LCS Privacy Class 



Provisioning State 


Registration State 


Activation State 


HLR Induction State 


(Not Provisioned, 


Not Applicable, 


Not Active, 


Not Induced) 


(Provisioned, 


Not Applicable, 


Active and Operative, 


Not Induced) 



For each LCS privacy class, the GMLC/PPR shall store the logical state of the class on a per-subscriber (or per 
subscriber MSP) basis. In addition, the permanent data indicated in Table 10.10 may be stored on a per subscriber (or 
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per subscriber MSP) basis when the logical provisioning state of the associated LCS privacy class is "provisioned". For 

the meaning of each LCS privacy class, refer to clause 9 and to TS 22.071 [4]. 

Moreover a list of allowed service types may be stored. The meaning of service types is defined in TS 22.071 [4]. 

Table 10.10: LCS data stored in the GMLC/PPR privacy exception list for an UE Subscriber 

(or UE Subscriber MSP) 



Service Types 





Service types list: a list of one or more service types for which the LCS 
client is allowed to locate the particular UE. The possible service types 
are defined in 22.071 . The following data may be present for each 
service type in the list: 







- Restriction on the GIVILC. If no value is stored for this data, there 
is no restriction on GMLC and any GIVILC is allowed to request 
location information for the UE. Possible values are: 

- Identified GMLCs only 

- Any GIVILC in the home country 




C 


Indication of one of the following mutually exclusive options: 

- Location allowed without notification (default case) 

- Location allowed with notification 

- Location with notification and privacy verification; location allowed if 
no response 

- Location with notification and privacy verification; location restricted if 
no response 



Table 10.11 : LCS Service types stored in the GMLC per UE subscriber 



Service type indication 



Status 



Additional HLR data when the indication is stored 



Service Types 



O 



Indication of one of the following mutually exclusive options for any 
service type not in the service type list: 

Location not allowed (default case) 

- Location allowed with notification 

Location with notification and privacy verification; location 
allowed if no response 

Location with notification and privacy verification; location 
restricted if no response 



Service types list: a list of one or more service types for which the LCS 
client is allowed to locate the particular UE. The possible service types 
are defined in 22.071 [4]. 

Restriction on the GMLC. If no value is stored for this data, 
there is no restriction on GMLC and any GMLC is allowed to 
request location information for the UE. Possible values are: 

- Identified GMLCs only 

Any GMLC in the home country 
Indication of one of the following mutually exclusive options: 
Location allowed without notification (default case) 
Location allowed with notification 

- Location with notification and privacy verification; location 
allowed if no response 

Location with notification and privacy verification; location restricted if no 
response 
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In case that UE"s privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, the GMLC/PPR shall 
store the same pseudo-external identity table with HLR, which is shown in Annex C. 

GMLC (H-GMLC) or PPR may store codeword handling information and a list of codewords given by the UE 
subscriber in order not to get the location request rejected. 

Table 10.12a: Codeword handling information stored in the GMLC 



Other Data in the GMLC 


Status 


Description 


Codeword handling 
information 





Indication of one of the following mutually exclusive options for 
codeword: 

- codeword shall be checked in network. 

- codeword shall be sent to UE 



Table 10.12b: LCS data stored in the GMLC for a UE Subscriber 



LCS Privacy profile 


Status 


Additional GMLC data when profile is provisioned 


Codeword 





A list of codeword. 



The GMLC (H-GMLC) or the PPR may store additional privacy information in order protect UE users privacy. The 
details of the additional privacy check are defined by each network operator and are outside the scope of this 
specification. 

10.4 Recovery and Restoration Procedures 

The LCS recovery and restoration procedures allow temporary data to be recovered or reinitialized following loss or 
corruption of data, such that normal LCS service is rapidly restored and inconsistency between the data held by 
different LCS network elements is removed. For a full description, refer to TS 23.007 [23]. 

10.5 Interworking between network nodes in different releases 

This clause describes possible scenarios for interworking between network nodes in different releases. It is noted that 
LCS is only supported in A-mode and lu-mode in the CS domain in Rel-99. LCS is supported in A-mode and lu-mode 
in UTRAN CS and PS domains, but not in Gb-mode, in Rel-4. LCS is supported in A/Gb mode and lu mode in CS and 
PS domains for UTRAN and GERAN from Rel-5 onwards. 

The concept of LCS capability set is introduced in Rel-4, so it does not appear in the specifications for R98 and R99 
LCS. 

10.5.1 LCS capability set 

The following LCS capabilities are identified in the current version of this specification. The HLR/HSS is notified the 
LCS capability of the serving node by an indication, which indicates all the LCS the serving node supports, from the 
serving node during location update procedure. 

- LCS capability set 1 : R98 and R99 LCS (pre-Rel"4 LCS) 

- LCS capability set 2: Rel"4 LCS 

- LCS capability set 3: Rel"5 LCS 

- LCS capability set 4: Rel"6 or later LCS 

Note: the concept of LCS capability set is introduced in Rel4 so that R98 and R99 serving nodes do not notify 
HLR/HSS this parameter. Therefore, even if this parameter is absent the serving node may support at 
most LCS capability set 1 . 
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The serving node, which notified the HLR/HSS that it supports LCS capabihty set 2, shall be able to handle the 
extended LCS Client list and LCS Client List for call-related class from the HLR/HSS. 

The serving node, which notified the HLR/HSS that it supports LCS capability set 3, shall support the following 
capabilities: 

capability to perform the service type privacy check. 

capability to send the codeword to target UE for notification/verification. 

capability to send the requestor ID to target UE for notification/verification. 

The serving node, which notified the HLR/HSS that it supports LCS capability set 4, shall support the following 
capability: 

capability to perform the privacy related action (i.e. checking the on-going call/session and/or 
notification/verification procedures) which is requested by H-GMLC. 

1 0.5.2 Interworking between pre Rel-4 serving node and Rel-4 or later 
HLR/HSS 

The serving node that supports only pre-Rer4 LCS cannot handle the extended privacy control for call-related/call- 
unrelated class of the Rer4 and later LCS. That is, the serving node cannot provide the extended call-related/call- 
unrelated class service to the user who subscribes to the Rer4 LCS. Therefore HLR does not send the LCS subscriber 
data on call-related/call-unrelated class for users who subscribe to the call-related class of Rer4 LCS to the serving node 
that supports only pre-Rer4 LCS. 

1 0.5.3 Interworking between pre Rel-5 serving node and Rel-5 or later 
HLR/HSS 

If the HLR/HSS is notified that the LCS capability set 3 is not supported by the serving node, itmay decide not to send 
the LCS subscriber data to the serving node, in order to protect user privacy. 

In addition, if the HLR/HSS is notified that the serving node does not support the LCS capability set 2, the procedures 
described in 10.5.2 also shall be applied. 

1 0.5.4 Interworking between pre Rel-6 network nodes and Rel-6 or later 
HLR/HSS 

In addition to the procedures in this section, if the HLR/HSS is notified that the serving node does not support the LCS 
capability set 2 and/or set 3, the procedures described in 10.5.3 shall be also taken into consideration. 

1 0.5.4.1 Rel-6 or later HLR/HSS with pre Rel-6 serving node 

The Rel-6 or later HLR/HSS notifies the H-GMLC about the all LCS capability set supported by the serving node. 

In accordance with the notified LCS capability of the serving node and the privacy profile of the target UE, the H- 
GMLC decides whether the location estimation process can be continued or not. 

In order to request the privacy related action (i.e. checking the on-going call/session and/or notification/verification 
procedures) to the pre Rel-6 serving node, H-GMLC may send the Provide Subscriber Location request message to the 
serving node with the pseudo-external identity. The detail of the pseudo-external identity is described in Annex C. 

10.6 LIMS-IWF 

As the LIMS-IWF is a simple interworking function that provides routing of LCS service requests and responses based 
on the target UE"s SIP-URI and mapping of SIP-URI to MSISDN it must not store user or LCS Ghent specific data 
during or after a location request procedure. 
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1 1 Operational Aspects 

11.1 Charging 

Charging Information collected by the PLMN serving the LCS Client. 

The following charging information shall be collected by the PLMN serving the LCS Client: 

type and identity of the LCS Client; 

identity of the target UE; 

results (e.g. success/failure, method used if known, response time, accuracy) - to be repeated for each instance of 
positioning for a deferred location request; 

- identity of the visited PLMN; 

- LCS request type (i.e. LDR or LIR); 

- requested Quality of Service information; 
state; 

type of event (applicable to LDR requests only); 

time stamp; 

type of co-ordinate system used. 

1 1 .2 Charging Information Collected by the Visited PLMN 

The following charging information shall be collected by the visited PLMN: 

date and time; 

type and identity of the LCS Client (if known); 

identity of the target UE; 

location of the target UE (e.g., MSC, MSC Server, SGSN, location area ID, cell ID, location co-ordinates); 

which location services were requested; 

requested Quality of Service information; 

results (e.g. success/failure, positioning method used, response time, accuracy) - to be repeated for each instance 
of positioning for a batch location request; 

- identity of the GMLC or PLMN serving the LCS Client; 
state; 

type of event (applicable to LDR requests only). 
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Annex A (normative): 

Privacy Class selection rule in serving node 

A.1 Interrelation among privacy settings 

There are five privacy settings and the interrelation among each privacy setting in terms of privacy strictness is shown 
as follows: 

Table A.I : Privacy settings 



loose 


Positioning allowed without notifying the UE user 


t 


Positioning allowed with notification to the UE user 




Positioning requires notification and verification by the UE user; positioning is allowed only if 
granted by the UE user or if there is no response to the notification 


i 


Positioning requires notification and verification by the UE user; positioning is allowed only if 
granted by the UE user 


strict 


Positioning not allowed 



A.2 Privacy class selection rule for pre Rel-6 mechanism 

In pre Rel-6 network, the users privacy profile (SLPP) is stored HLR/HSS and is downloaded to the serving 
MSC/SGSN. If more than one privacy class are subscribed or in case Service Types and at least one privacy class are 
subscribed, privacy class for an MT-LR is selected by the serving MSC/SGSN according to the flow diagram shown in 
Fig. A-1. 

An MT-LR may be applied to more than one privacy class or to Service Types and one or more privacy classes. In this 
case, looser privacy setting shall be selected. The privacy settings to be compared are the results of the privacy checks 
for each applicable class and Service Type. 



£75/ 



3GPP TS 23.271 version 6.10.0 Release 6 



105 



ETSI TS 123 271 V6.10.0 (2004-12) 




PLMN Operator 
class 



The location request is not 
aiiowed unconditionally 



Yes 



Yes 



Call Related/Call 
Unrelated class 

[Note4] 





Tine location request is not 
aiiowed unconditionally 



Call Related 
class 



The location request is not 
allowed unconditionally 



Figure A.I : Privacy Class selection flow diagram 

Note 1 : The client type indicates PLIVIN Operator service, and tlie client is within or associated with the VPLMN. 
Note 2: The client type indicates value added service; the UE originated call/session to the requesting LCS client is 

established and the address associated to the LCS client used by the UE in call/session set up matches 

with that contained in the location request. 
Note 3: The client type indicates value added service. 
Note 4: The looser privacy setting shall be selected. 

If the user subscribes Service Types, once that the privacy class has been selected according to figure A. 1, the resulting 
privacy setting shall be compared with the result of Service Type privacy checking, and the looser condition shall be 
applied to the MT-LR, provided that the LCS client was authorized by the UE user to get location information. 

A.3 Privacy related action selection rule for Rel-6 and later 

In Rel-6 and later, the privacy checking function is moved from MSC/SGSN to H-GMLC/PPR of the target UE. H- 
GMLC/PPR selects one or two indicators of privacy check related action and sends the indicators to serving 
MSC/SGSN as shown in the clause 9.5.4. If the user subscribes Service Types, the resulting privacy setting shall be 
compared with the result of Service Type privacy checking, and the looser condition shall be selected. The Service 
Type check result may be included in any of the two privacy indicators, provided that the MT-LR is allowed for the 
relative privacy class. 

If the serving MSC/SGSN receives the indicators from H-GMLC, the serving node selects the privacy related action 
according to the flow diagram shown in Fig. A-2. 
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Call/session 
related class 



Call/session 
unrelated class 



The location request 
is not allowed 
unconditionally 



Figure A.2: Privacy related action selection flow diagram of the serving node 

Note 1 : The UE originated call/session to tlie requesting LCS client is established and the address associated to 
the LCS client used by the UE in call/session set up matches with that contained in the location request. 

Note 2: A prior change makes this check unnecessary; since the call unrelated indicator is mandatory therefore the 
result is always "YES". 
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Annex B (normative): 

Presence of LCS client ID Components in IVIT-LR 

The LCS client identity is composed of one or more than one of the following components: LCS client type, external 
identity, internal identity, call/session related identity, APN-NI, client name and Requestor Identity. For Value added 
LCS client type it may contain also Client name and Requestor ID type indicator. The LCS client type shall always be 
present and for each LCS client type the presence of the other components are defined as follows: 



Component 
LCS Client type 


External 
identity 


Internal 
identity 


Call/session 
related identity 


Client name 


Requestor 
Identity 


Emergency 


O 


N.A. 


N.A. 


N.A. 


N.A. 


Value added 


M 


N.A. 


O [Note] 


M 


O 


PLMN operator 


N.A. 


M 


N.A. 


N.A. 


N.A. 


Lawful Intercept 


N.A. 


N.A. 


N.A. 


N.A. 


N.A. 



Note: This component shall be present if the MT-LR is associated to either CS call or PS session. If the MT-LR 
is associated with the CS call, the number dialled by UE is used. Otherwise if the MT-LR is associated 
with the PS session, the APN-NI is used. 
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Annex C (Informative): 
Pseudo external ID 



In case that UE"s privacy profile is stored and is checked in the GMLC (H-GMLC) or in the PPR, a pseudo-external 
identity may be selected as a result of the privacy check in GMLC/PPR. 

The pseudo-external identities may be set in the external LCS client list of the HLR privacy exception list shown in 
Table 10.2. The pseudo-external identity is not the identity of real external LCS client but the identity which is used for 
notifying SGSN/MSC of the location request class (call/session related or non-related) and the required type of 
indication for each class. Operator allocates E.164 addresses for the pseudo-external identities. The pseudo-external 
identities are used for interworking with pre Rel-6 serving nodes. 

Fourteen pseudo-external identities shall be defined. The pseudo-external identities are summarized in the Table C.l. 

Table C.I : Pseudo-external identities 



Pseudo-external identity 


Privacy setting for Call/Session 
related class 


Privacy setting for Call/Session 
unrelated class 


Pseudo-external identity 1 


N.A. 


Location allowed without 
notification 


Pseudo-external identity 2 


N.A. 


Location allowed with notification 


Pseudo-external identity 3 


N.A. 


Location with notification and 
privacy verification; location allowed 
if no response 


Pseudo-external identity 4 


N.A. 


Location with notification and 
privacy verification; location 
restricted if no response 


Pseudo-external identity 5 


Location with notification and 
privacy verification; location 
restricted if no response 


Location not allowed 


Pseudo-external identity 6 
Indicator 6 


Location with notification and 
privacy verification; location 
allowed if no response 


Location not allowed 


Pseudo-external identity 7 


Location with notification and 
privacy verification; location 
restricted if no response 


Pseudo-external identity 8 


Location allowed with notification 


Location not allowed 


Pseudo-external identity 9 


Location with notification and 
privacy verification; location 
restricted if no response 


Pseudo-external identity 10 


Location with notification and 
privacy verification; location allowed 
if no response 


Pseudo-external identity 1 1 


Location allowed without 
notification 


Location not allowed 


Pseudo-external identity 12 


Location with notification and 
privacy verification; location 
restricted if no response 


Pseudo-external identity 13 


Location with notification and 
privacy verification; location allowed 
if no response 


Pseudo-external identity 14 


Location allowed with notification 
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Note: There are five privacy settings shown in Annex A. 1 for each class (call/session unrelated class and 
call/session related class), so there are twenty-five possible combinations of the privacy settings. 
However, as shown in Annex A.2, even if the call/session related class criteria is met, the privacy setting 
for call/session unrelated class is selected when the privacy setting for the call/session unrelated class is 
looser than the privacy setting for the call/session related class. Therefore the twenty-five combinations 
can be reduced to the above fourteen combinations. 

If the UE subscribes to the universal or PLMN class, H-GMLC/PPR sends the pseudo external identity 1 to the serving 
nodes. 

Usage of the pseudo-external identities are as follows: 

The pseudo-external identities are registered in SLPP of the HLR/HSS. 

The SLPP is sent to the serving nodes, during the Insert Subscriber Data procedures. 

After the privacy check in the H-GMLC/PPR, the H-GMLC/PPR selects an appropriate pseudo-external identity 
according to the required privacy related actions (i.e. checking the on-going call/session and/or 
notification/verification procedures) in the serving node. 

H-GMLC sends Provide Subscriber Location message to the serving node, which includes the pseudo-external 
identity instead of the real external client identity. The real external client identity may be included in the 
additional information element and is sent to serving node. The pseudo-external identity is sent to the serving 
node directly from H-GMLC or via V-GMLC. 

Table C.2 and C.3 shows how the pseudo-external identities are set in the SLPP in HLR/HSS. 

Table C.2: Example of SLPP in HLR/HSS for Call/Session unrelated Class 



Pseudo-external identity 


Privacy Setting 


Pseudo-external identity 1 


Location allowed without notification 


Pseudo-external identity 2 


Location allowed with notification 


Pseudo-external identity 3 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 4 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 5 


Location not allowed 


Pseudo-external identity 6 


Location not allowed 


Pseudo-external identity 7 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 8 


Location not allowed 


Pseudo-external identity 9 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 10 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 1 1 


Location not allowed 


Pseudo-external identity 12 


Location with notification and privacy verification; location 
restricted if no response 


Pseudo-external identity 13 


Location with notification and privacy verification; location 
allowed if no response 


Pseudo-external identity 14 


Location allowed with notification 


Table C.3: Example of SLPP in HLR/HSS for Call/Session related Class 


Pseudo-external identity 


Privacy Setting 
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Pseudo-external identity 5 



Location with notification and privacy verification; location 
restricted if no response 



Pseudo-external identity 6 



Location with notification and privacy verification; location 
allowed if no response 



Pseudo-external identity 7 



Location with notification and privacy verification; location 
allowed if no response 



Pseudo-external identity 8 



Location allowed with notification 



Pseudo-external identity 9 



Location allowed with notification 



Pseudo-external identity 10 



Location allowed with notification 



Pseudo-external identity 1 1 



Location allowed without notification 



Pseudo-external identity 12 



Location allowed without notification 



Pseudo-external identity 13 



Location allowed without notification 



Pseudo-external identity 14 



Location allowed without notification 



The selection of pseudo-external identity is based on the result of the privacy check in the H-GMLC/PPR. Table C.4 
shows the relation between privacy check result and the pseudo-external identities. 

Table C.4: Pseudo-external identity selection at H-GMLC/PPR 



Privacy related actions as a result of privacy check 


Pseudo-external identity 


Location request is allowed without notification, regardless 
of on-going call/session. 


Pseudo-external identity 1 


Location request is allowed with notification, regardless of 
on-going call/session. 


Pseudo-external identity 2 


Location request is allowed with notification and privacy 
verification, regardless of on-going call/session. Location 
request is allowed even if there is no response from UE. 


Pseudo-external identity 3 


Location request is allowed with notification and privacy 
verification, regardless of on-going call/session. Location 
request is restricted if there is no response from UE. 


Pseudo-external identity 4 


If there is call/session with the client, location request is 

allowed with notification and privacy verification. 

Location request is restricted if there is no response from 

UE. 

If there is no call/session with the client, location request is 

restricted. 


Pseudo-external identity 5 


If there is call/session with the client, location request is 

allowed with notification and privacy verification. 

Location request is allowed even if there is no response 

from UE. 

If there is no call/session with the client, location request is 

restricted. 


Pseudo-external identity 6 


If there is call/session with the client, location request is 
allowed with notification and privacy verification. 
Location request is allowed even if there is no response 
from UE. 

If there is no call/session with the client, location request is 
allowed with notification and privacy verification. 
Location request is restricted if no response. 


Pseudo-external identity 7 


If there is call/session with the client, location request is 
allowed with notification. 

If there is no call/session with the client, location request is 


Pseudo-external identity 8 
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restricted. 




If there is call/session with the client, location request is 
allowed with notification. 

If there is no call/session with the client, location request is 
with notification and privacy verification. Location request 
is restricted if no response. 


Pseudo-external identity 9 


If there is call/session with the client, location request is 
allowed with notification. 

If there is no call/session with the cUent, location request is 
allowed even if there is no response from UE. 


Pseudo-external identity 10 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the client, location request is 
restricted. 


Pseudo-external identity 1 1 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the cUent, location request is 
with notification and privacy verification. Location request 
is restricted if no response. 


Pseudo-external identity 12 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the cUent, location request is 
allowed even if there is no response from UE. 


Pseudo-external identity 13 


If there is call/session with the client, location request is 
allowed without notification. 

If there is no call/session with the client, location request is 
allowed with notification. 


Pseudo-external identity 14 
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Annex D (normative): 

including Requestor identity to LCS client name 

In case the MSC/SGSN or the UE is pre Rel-5 then there is no possibiHty to send the Requestor identity to the UE in a 
new separate parameter. To obtain this backward compatibility the GMLC can add the Requestor identity to LCS cUent 
name. 

In order to offer best possible service for the end user the UE should be able to differentiate LCS client name and 
Requestor ID when they are included in to a same parameter. Also it is important that the LCS client name and the 
Requestor ID are separated with a consistent manner. Therefore there is a need to define a rule how the GMLC should 
separate LCS client name and Requestor identity. In the box below is described the practice how the LCS cUent name 
and Requestor identity should be separated. 



LCS clientName==RequestorIdentity 



LCS client name and Requestor identity are separated with two equal signs. 

Note: It is possible that the Requestor identity does not fit into the LCS client name field. In that case as many 
characters as possible from the beginning is added to the LCS client name field. 
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Annex E (Informative): 

Handling of pseudonyms in location services 

There is a requirement in place on anonymity for both the requestor and the target in the LCS Stage 1, TS22.071, and 
there are or will be regulatory requirements to support anonymity in location services in some countries. It is seen as a 
basic service requirement that the user should be able to request anonymity at will. 

There are various methods available for providing anonymity-support for LCS. One model has been described by the 
GSM Association in the LS in tdoc S2-021104 to 3GPP. In short, GSMA"s model introduces the following logical 
architecture. 

7. Service response 

< 



Terminal 


9. Service response 


1 . Service request^ 





2. Obtain 
pseudonym 




3. Service request 



LCS client 




with pseudonym 
8. Obtain MSISDN 

1 
5. Obtain verinym 

< ► 



■iT 

I 



GMLC/ 
PPR 



4. Location request 
with pseudonym 
6. Location response 



Figure E.I ; GSMA logical model to support anonymity 

In this PUSH model the pseudonym of the target UE is always generated for certain LCS clients on behalf of the 
terminal"s subscriber without a specific request. 

The PUSH model describes the case when the target UE requests its own location using e.g. SMS or WAP. SMS and 
WAP functions currently have problems in supporting anonymity, because the SMSAVAP gateways forward the 
originating MSISDN to the receiver. This weakness may be resolved in practise e.g. such that the SMS or WAP 
Gateway requests pseudonyms from a common device (PMD), as shown in Figure E. L In this process the gateway 
requests a pseudonym from PMD in signalling step 2 and in signalling step 3 the gateway uses the pseudonym in the 
service request that it sends to the LCS client. The gateway includes the requesting terminals verinym, i.e. the 
MSISDN, in the service response it sends to the terminal in step 9. In this way the LCS client only knows the 
pseudonym of the terminal and not the verinym. This solution is not LCS specific, since the SMSAVAP gateway inserts 
pseudonyms in all SMSAVAP messages, which the gateway forwards to the receivers (LCS clients) defined by the 
operator in advance. 

The Liberty Alliance Project has standardized methods that can be used to ensure the anonymity of the target UE in 
location services using pseudonyms as shown by the example in Figure E.2 below. The specifications of the Liberty 
Alliance project are publicly available at http://www.projectliberty.org/. 
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Terminal 



10. Final Ser. Resp. 

< 



1 . Service request 



Liberty 
enabled 
Proxy/ 
Gateway 



4. Obtain pseudonym 



9. Anonym Ser. Resp 

< 



2. Anonym Ser. Req. 
► LCS 

3. Pseudonym req. client 



5. Pseudonym resp. 



PPR/PMD 
(IPD) 



7. Obtain Verinym 
< ► 



6. Location request 
8. with pseudonym 

8. Location 
response 



GMLC 



Figure E.2; Logical model to support anonymity 

In this PULL model the LCS client requests the pseudonym from the Gateway before accepting the service request from 
the terminal. The proxy/gateway is a so-called Liberty Enabled Client/Proxy, which also may support standard WAP 
proxy/gateway functions as described in the appropriate WAP Forum specifications. 

1 . The terminal (UE) sends a standard Wireless Transport Protocol (WTP) -request to the Proxy/Gateway. 

2. The proxy/gateway converts the service request into an HTTP-request with a dynamic IP address. This HTTP- 
request does not contain the MSISDN of the terminal, so it is totally anonymous to the LCS-client. 

3. The LCS-client needs to get an assertion, i.e. a pseudonym, before it can accept to provide location services to 
the terminal, so it sends a HTTP-response to the Proxy/Gateway, which includes a request for a pseudonym. 

4. The proxy/gateway maps the LCS client"s HTTP-response to the HTTP -request it sent in step 2 and thus the 
proxy/gateway also knows to which terminal the LCS client"s HTTP-response is related. The proxy/gateway 
intercepts and interprets the HTTP-response and finds the pseudonym request. It forwards the pseudonym 
request to PMD and attaches the terminals MSISDN to allow the PMD to provide a pseudonym related to this 
MSISDN. In case PMD needs to contact the target UE user for some reason, e.g. to ask for consent to deliver the 
pseudonym to this specific LCS-client, this interaction is fully supported in the Liberty Enabled Client/Proxy 
specification. 

5. The proxy/gateway sends an HTTP-request containing the pseudonym to the LCS-client. 

6. The LCS-client sends a location service request to GMLC using the pseudonym of the target terminal. 

7. The PMD may include the MSISDN in the pseudonym by encrypting it in such a way that GMLC is able to 
determine the MSISDN itself and in such a case step 7 is not needed. In case GMLC cannot find out the verinym 
of the terminal itself, it requests from PMD the MSISDN that corresponds to the pseudonym it received from the 
LCS-client. 

8. GMLC provides location information to the LCS-client using the pseudonym of the target terminal. 

9. The LCS-client sends an HTTP-response to the proxy/gateway containing the requested location specific service 
content. 

10. The proxy/gateway maps the response to the outstanding request sent in step 1 and delivers the result to the 
correct terminal using MSISDN. 

Note that the mechanism described above is a generalized solution to the problem of transporting something from party 
1 (PMD) to party 3 (GMLC) so that intermediate party 2 (LCS-client) cannot find out the real content transferred 
between party 1 and party 3 (verinym in this case). Also note that since the proxy/gateway does not push any 
pseudonym in step 2, it is not required to understand the destination application and what information it may need. Step 
3 allows any application to request a pseudonym or any information it may need, thus making this a generalized 
solution, which may be used for many types of applications, not only LCS. 

It is to be noted that the Liberty release 1.1 specification has been carefully studied by the EU article 29 committee and 
found to be in accordance with the current EU privacy requirements. It is stressed, however, that it is the responsibility 
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of someone implementing or deploying a system in accordance with the Liberty Alliance specifications to comply with 
EU directives and requirements on privacy. 

For roaming cases chapter 9.1.1 in this specification describes the cases where the pseudonym contains the address(es) 
of the target UE"s Home-GMLC so that the Requesting-GMLC can forward the location request to H-GMLC, which 
may determine the corresponding verinym itself or request the verinym from its associated PMD. 
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Annex F (Informative): 

Mechanism for performing Change of Area Event Detection 

Note: the classification (i.e. normative or informative) of this Annex is FFS. 

As described in section 9.1.9 that there may be alternative mechanisms to transfer the deferred MT-LR with Area Event 
request to the UE. This annex illustrates one mechanism. In this mechanism a Short Message Service (SMS) is used to 
transfer, to the UE/(U)SIM, the Area event detection request via an (U)SIM Application Toolkit application. 

F.1 (U)SIM Application Toolkit (USAT) Based Solution 

In this (U)S AT based solution, the area event detection mechanism relies on the proactive control of the UE by the 
(U)SIM using the (U)S AT commands controlled by a specific Change of Area Deferred Location application. Figure 
F. 1 illustrates one possible method for downloading a change of area event application to the UE, but does not detail the 
operation of the application. The details of the application is outside the scope of this specification. Further information 
about the possible (U)SAT commands, can be found from TS 31.111. 

The following procedure (shown in Figure F. 1) replaces Figure 9.6d in clause 9.1.9. 



LCS Client 



R-GMLC 



1. LCS Service Request 



H-GMLC 



MSC / SGSN 



UE/(U)SIM 



2. Common Procedures for LCS 



5. LCS Service Response 



9. LCS Service Response 
I ^-^^<— 



3. USAT Application Delivery - Change of Area Event 
Invoke + Notification 



4. USAT Application Delivery Acknowledge 



g 7. Change of Area Event Report 



8. Privacy Check 



6. Event Occurs 



Figure F.l: (U)SAT Application Download and Change of Area Event Detection Procedure 

1) This step is the same as step 1 in clause 9.1.9. 

2) This step is similar to step 2 in clause 9.1.9, except the LCS Service Request does not reach the V-GMLC. Also 
the H-GMLC may request a translation of geographic shape to network identities from a GMLC in the network 
serving the target UE. 

3) Information about the event, the (U)SAT appUcation, that shall trigger the sending of the Location Report shall 
be sent to the UE/(U)SIM. If privacy action (notification and/or verification) was requested as a result of the 
privacy check, the H-GMLC shall also include the required action to the UE/(U)SIM. If notification/verification 
is required, the request shall indicate the identity of the LCS client, the Requestor Identity (if available), and the 
reference number. The mechanism by which the trigger detection is performed via (U)SAT application may be 
operator dependent. However, the (U)SAT Application shall contain the following information: reference 
number, H-GMLC address, validity period of request, and the area definition (of the target area). 

4) If privacy verification was requested, the UE/(U)SIM indicates to its user whether the location request will be 
allowed or not allowed in the absence of a response and waits for the user to grant or deny permission. If privacy 
verification was requested and the user grants permission, the USAT Application shall be installed and the 
UE/(U)SIM then returns an acknowledgement to the H-GMLC indicating permission is granted and (U)SAT 
application is successfully installed. If the UE user does not respond after a predetermined time period (and the 
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request is not allowed in the absence of a response) or denies permission, the UE/(U)SIM shall infer a "no 
response" condition, the USAT Application is not installed, an appropriate error response is returned to the 
GMLC/LCS Client and the remaining steps are skipped. Otherwise the UE/(U)SIM notifies the UE user of the 
location request (if required by the privacy action) and shall install the (U)S AT application and acknowledge 
successful installation to the H-GMLC, including an indication of 'no response' but request is allowed if 
necessary. If at any point the (U)SAT application fails to install, due to lack of support or otherwise, the 
UE/(U)SIM shall inform the H-GMLC using an appropriate error cause. 

5) The H-GMLC returns a LCS Service Response via R-GMLC to the LCS Client to notify whether the request was 
successfully accepted/installed or not, without a location estimate. When the R-GMLC returns the LCS Service 
Response to the LCS Client, the LDR reference number assigned by the R-GMLC shall be included. 

6) The UE/(U)SIM detects the desired change of area event. 

7) The UE/(U)SIM reports the change of area event. 

8) The H-GMLC may perform another privacy check as described in clause 9. L L 

9) The H-GMLC then returns a LCS Service Response to the LCS Client via the R-GMLC, if applicable, as in 
9.1.L When the R-GMLC returns the LCS Service Response to the LCS Client, the LDR reference number that 
was sent to the LCS Client in step 5 shall be included. If the GMLC for some other reason decides to not wait 
any longer for the requested event to occur (e.g. timer expires), an LCS Service Response shall be returned with 
an appropriate error cause indicating termination of the deferred location request. 

H-GMLC may be the origination point of the SMS-DELIVER and the USAT Application messages. 
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